84698[.]xyz

On 23 July 2026 the domain 84698.xyz was observed as an offline infrastructure used to impersonate Bet365. The domain was registered on 7 January 2026 through Gname.com Pte. Ltd. and resolves to the IPv4 address 45.196.247.189, which is announced by AS140224 (Nebula Global LLC) and geolocated to Hong Kong. The host presents an SSL certificate identified as R13, indicating the use of a low‑trust certificate. The HTTP response previously returned a page whose title was “welcome‑BET365”, matching the declared brand target Bet365 and the scam type “Crypto Gambling”.

Reputation checks show a Gridinsoft trust score of 0 / 100 and detection by 14 of 93 VirusTotal scanners. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. AlienVault OTX references the domain in two separate threat‑intel pulses, further confirming its malicious use. The combination of a fresh registration, low trust score, hostile SSL, and multiple vendor detections suggests a purpose‑built phishing or crypto‑gambling lure aimed at Bet365 customers.

No public evidence of the page content, login fields, or payload has been released, so the exact phishing kit or credential‑harvesting technique remains unknown. Analysts should continue to monitor the IP address 45.196.247.189 for any re‑activation, enforce blocklists that include 84698.xyz, and consider adding the ASN or host to network‑level deny lists. Additional scrutiny of other domains registered by the same registrar during the same period may reveal related infrastructure. Defenders are advised to educate Bet365 users about unsolicited links that reference “welcome‑BET365” and to verify TLS certificates before entering credentials.