h83v[.]xyz

Analysis of the domain h83v.xyz indicates a short‑lived infrastructure used to impersonate the online betting service Bet365. The site was registered on 21 February 2026 and is currently listed as offline. The page title returned from the server, “welcome‑BET365”, directly references the targeted brand, confirming a brand‑impersonation motive. Network resolution points to the IPv4 address 45.196.247.146, which belongs to AS140224 Nebula Global LLC and is geolocated in Hong Kong. The same IP address is associated with a low trust rating from multiple reputation services: Scamadviser assigns a score of 1 / 100, Gridinsoft 0 / 100, and the domain appears on one external security blocklist.

AlienVault’s Open Threat Exchange has recorded the domain in two separate threat pulses, providing additional corroboration of malicious activity. VirusTotal analysis shows that 12 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent. The site was also blocked by the anti‑phishing service PhishDestroy. The declared SSL certificate version “R12” offers no indication of legitimate certification and is consistent with a hastily provisioned or self‑signed certificate often observed in fraudulent deployments.

The scam type is identified as “Crypto Gambling,” suggesting that any lures likely involve promises of cryptocurrency‑based betting or winnings. While the domain is no longer reachable, defenders should still monitor the associated IP address and ASN for possible reuse, update URL filtering rules to block h83v.xyz, and ensure that endpoint protection products flag any future connections to this host. Additional investigation of the two OTX pulses may reveal related indicators such as shared command‑and‑control servers or phishing templates. In the absence of live content, the available evidence is sufficient to classify h83v.xyz as a high‑risk, brand‑impersonation phishing domain targeting Bet365 users.