bet397[.]cc

This domain, bet397.cc, is flagged as a brand-impersonation threat targeting Bet365, a well-known online betting platform. Analysis indicates the site was designed to mimic the legitimate Bet365 portal, likely to harvest user credentials, payment details, or other sensitive information through deceptive login or deposit interfaces. No evidence of a drainer kit was identified in the available data, but the absence of SSL encryption and the domain's structure align with common phishing infrastructure patterns. Infrastructure analysis reveals concrete technical indicators of compromise. The domain resolves to IP address 122.10.20.121, hosted on AS134548 in Hong Kong, and was registered on November 11, 2025, through GoDaddy.com, LLC. VirusTotal detection rates show 21 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and lacks any valid SSL certificate, further confirming its fraudulent nature. As of the latest assessment, bet397.cc has been taken offline, reducing immediate exposure to end users. However, residual risk remains due to potential cached DNS records, browser history entries, or phishing campaigns that may have distributed the domain via email or messaging platforms. Organizations and individuals are advised to monitor for unauthorized access attempts, reset credentials if exposure is suspected, and implement DNS-based blocking for the domain and its associated IP address. Proactive threat hunting for related indicators, such as the registration pattern or hosting provider, is recommended to identify potential follow-up campaigns.