0371365vip[.]vip

The domain 0371365vip.vip is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Bet365 brand. Infrastructure analysis shows the domain resolves to IP address 38.181.35.120, which is announced by AS140227 Hong Kong Communications International Co., Limited and geolocated to Hong Kong. Registration occurred on February 21, 2026 through Dynadot LLC, and the authoritative name servers are clayton.ns.cloudflare.com and fatima.ns.cloudflare.com, indicating use of Cloudflare’s DNS platform. The TLS certificate presented is issued to Henan Fierce Fire Network Technology Co., Ltd. under the CNSSL DV TLS G2 R36 CA, a credential that does not appear to be associated with the legitimate Bet365 service. The page title returned by the web server contains a Chinese description that references Bet365 sports betting, European football leagues, PGA golf tournaments, live casino, and integrated games, reinforcing the claim of brand impersonation. VirusTotal scans report that 20 of 93 security vendors flagged the domain, and the site is listed on a single security blocklist. It has been blocked by the PhishDestroy feed and appears in one AlienVault OTX pulse. The Gridinsoft trust score is 0 / 100, reflecting a lack of confidence in the domain’s legitimacy. While the HTTP response code is 200, the content of the site has not been independently verified beyond the title string. Defenders should consider immediate network‑level blocking of both the domain and its resolved IP, add the domain to URL filtering policies, and monitor for any related infrastructure reuse. Additional investigation of the hosted content and any credential‑phishing vectors is recommended to confirm the full scope of the impersonation attempt.