bet365[.]casinologinonline[.]com

The domain bet365.casinologinonline.com is currently active and identified as a credential-phishing site specifically targeting users of the Bet365 brand. This domain presents a fake login page titled "Bet365(JP)", designed to harvest user credentials under the guise of the legitimate Bet365 platform. Analysis indicates this is a high-risk threat due to its active status and direct impersonation of a well-known gambling service. Infrastructure analysis reveals the domain was registered on August 13, 2021, through NAMECHEAP INC. It resolves to the IP address 31.131.20.214 and has been flagged by 22 of 95 security vendors on VirusTotal as malicious. The page title, "Bet365(JP)", suggests a targeted approach toward Japanese-speaking users, though no additional language-specific indicators were confirmed in this assessment. The domain remains unblocked by many security providers, increasing its potential reach. As of this report (seed af563b), bet365.casinologinonline.com is still active and operational. Organizations and individuals are advised to block this domain at the network level, update endpoint protection rules to include the IP 31.131.20.214, and alert users to the presence of this credential-phishing campaign. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate further malicious infrastructure.