x78d[.]xyz

Analysis of the domain x78d.xyz, observed on July 23, 2026, indicates a brand‑impersonation campaign targeting Bet365. The site was registered on February 21 2026 and currently reports an offline HTTP status, suggesting the infrastructure has been taken down or is no longer serving content. DNS resolution points to the IPv4 address 45.196.247.145, which belongs to autonomous system AS140224 operated by Nebula Global LLC and geolocated to Hong Kong. The TLS certificate presented is identified as rating “R13”, confirming that encrypted transport was in place while the site was active.

The page title returned by the server is “welcome‑BET365”, directly referencing the targeted brand. Intelligence categorizes the operation as a crypto‑gambling scam, a common vector for illicit gambling platforms that solicit cryptocurrency deposits. VirusTotal scans have logged 13 positive detections out of 93 participating security vendors, indicating that a notable minority of scanners consider the domain malicious. AlienVault’s Open Threat Exchange lists the domain in one threat‑intel pulse, and the domain appears on a single external blocklist, specifically PhishDestroy, which has actively blocked traffic to the host.

Despite the offline status, the observed indicators suggest a coordinated attempt to deceive Bet365 customers and harvest cryptocurrency. Defenders should continue to monitor the IP address 45.196.247.145 for any re‑activation or related host activity, ensure that outbound traffic to this address is denied at perimeter firewalls, and add the domain to internal blocklists. Threat‑intel teams are advised to correlate this indicator with any reported incidents involving Bet365‑related credential or payment requests, especially those that reference cryptocurrency transactions. Ongoing vigilance is recommended until the infrastructure is confirmed inert.