bet389[.]cc

The domain bet389.cc is flagged as a brand‑impersonation site targeting Bet365. Registration data shows the domain was created on 16 October 2025 through GoDaddy.com, LLC and uses the authoritative name servers n1.xundns.com and n2.xundns.com. DNS resolution points to IP address 122.10.20.121, which belongs to AS134548 DXTL Tseung Kwan O Service in Hong Kong. The site presented a TLS certificate issued by GoDaddy Secure Certificate Authority – G2, confirming the use of a valid‑looking SSL chain despite the malicious intent.

The page title returned by the server was "bet365", directly matching the protected brand and reinforcing the impersonation claim. Reputation services assign extremely low scores: Gridinsoft rates the domain 0 / 100, Scamadviser 1 / 100, and the domain is listed on at least one public blocklist. PhishDestroy has actively blocked the domain, and VirusTotal records indicate that 15 of 95 scanned security vendors flagged the site as malicious. AlienVault OTX references the domain in two distinct threat‑intel pulses, further corroborating its association with illicit activity.

The scam type is identified as crypto gambling, suggesting the site attempted to lure victims into fraudulent wagering or cryptocurrency transactions. As of the report date, the domain is taken offline, but the infrastructure footprint remains observable and may be re‑used in future campaigns. Defenders should continue to monitor the IP range and name‑server pair, enforce blocklist entries, and consider sinkholing the domain to prevent re‑activation. Incident response teams are advised to update brand‑protection rules for Bet365 to include bet389.cc and to audit any traffic attempting to resolve this host.