h84t[.]xyz

Analysis of h84t.xyz confirms its classification as a phishing domain targeting Bet365, a well-known gambling brand, with a focus on crypto gambling fraud. The domain was registered on December 30, 2025, through Gname.com Pte. Ltd., and currently resolves to the IP address 103.233.249.125, hosted in Hong Kong under AS132839 (POWER LINE DATACENTER). No SSL certificate is present, increasing the likelihood of unencrypted data transmission and potential exposure of victim credentials. The page title, 'welcome-BET365,' directly references the impersonated brand, and the domain is explicitly categorized as a crypto gambling scam in available threat intelligence.

Defenders should note that h84t.xyz appears on one security blocklist (PhishDestroy) and is flagged by 15 of 93 security vendors on VirusTotal, indicating moderate detection coverage. AlienVault OTX also lists the domain in one threat intelligence pulse, suggesting prior malicious activity. The domain's nameservers (ns1.1111343.com, ns1.dnsbm.com, and others) are consistent with infrastructure observed in other phishing campaigns, though no specific phishing kit has been identified in the available data. As of July 23, 2026, the domain is offline, but defenders should treat any reactivation as high-risk.

The absence of SSL, combined with the domain's registration details and hosting provider, aligns with patterns seen in transient phishing operations designed to evade takedowns. While the exact content and functionality of the site remain unanalyzed, the available evidence—including the page title, brand impersonation, and scam classification—supports its designation as a confirmed threat. Organizations should block the domain at the DNS level and monitor for related infrastructure, particularly under the same ASN or registrar. If historical logs exist, review for connections to 103.233.249.125 or interactions with the 'welcome-BET365' page title to identify potential compromise.