84643[.]xyz

This domain, 84643.xyz, is identified as a brand impersonation threat specifically targeting Bet365, a well-known online betting platform. The site displays a page title of 'welcome-BET365,' a clear indicator of intent to mimic the legitimate Bet365 brand for fraudulent purposes. No evidence of a crypto drainer kit or direct credential harvesting mechanism was observed in the available data, but the domain’s infrastructure and naming conventions strongly suggest it was designed to deceive users into believing they are interacting with the official Bet365 service. The threat type aligns with typical brand impersonation tactics, where attackers exploit trust in established brands to facilitate unauthorized transactions or data theft. Analysis of technical indicators reveals significant red flags. The domain is flagged by 14 out of 95 security vendors on VirusTotal, indicating broad consensus among cybersecurity tools regarding its malicious nature. It was registered on February 21, 2026, through an undisclosed registrar, and resolves to the IP address 45.196.247.191. The domain appears on one security blocklist and has been included in two threat intelligence pulses on AlienVault OTX, further corroborating its association with malicious activity. The SSL certificate, identified as R13, does not provide additional trust signals, as fraudulent domains often employ low-cost or automated certificates to appear legitimate. No Google Safe Browsing (GSB) status was provided, but the combination of other indicators leaves little doubt about the domain’s intent. As of the latest assessment, 84643.xyz has been taken offline, reducing immediate exposure to potential victims. However, the domain’s infrastructure remains a residual risk, particularly if the operators reactivate it or repurpose the associated IP address for future campaigns. Users who may have interacted with the domain are advised to monitor their accounts for unauthorized activity, reset credentials for any services accessed during the exposure window, and report the incident to relevant fraud prevention authorities. Organizations targeted by such impersonation schemes should consider proactive measures, including domain monitoring, takedown requests, and user education to mitigate the risk of similar threats in the future.