Skip to security report
Analytics Dashboard
⚠️
This domain has been flagged as malicious
Security engines reporting a detection: 19. Exercise extreme caution — do not enter credentials or personal information.
Domain security and threat intelligence

j39b[.]vip

“welcome-BET365”

Threat verdict Critical 95/100 evidence score
Availability Unverified Current reachability is unverified
Risk signals
VirusTotal detections: 19/91 Spamhaus DBL: DBL_SPAM Brand impersonation: Bet365
Jun 2, 2026 Bet365

Evidence Summary

CRITICAL
Evidence score
95/100

Analysis of the domain j39b.vip indicates an active high‑risk brand‑impersonation campaign targeting Bet365. The domain was registered on May 04, 2026 through Gname.com Pte. Ltd. and serves a page titled "welcome-BET365" with an HTTP 200 response. The site presents a default SSL certificate issued to Default Company Ltd, suggesting the certificate was not specifically obtained for the fraudulent operation. The page title directly mirrors the legitimate brand, reinforcing the impersonation intent.

Infrastructure examination shows that j39b.vip resolves to IP address 154.39.104.142, which is assigned to AS4837 CHINA UNICOM China169 Backbone and geolocated to China. The domain utilizes a set of six nameservers: ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and ns4. These nameservers are commonly observed in other malicious hosting configurations, indicating possible reuse of compromised or rented DNS services. The IP and DNS footprint are consistent with previously observed Chinese‑based phishing infrastructure.

Detection metrics reveal that VirusTotal has flagged the domain in 22 out of 95 security vendor scans, and the domain appears on one public blocklist. Gridinsoft assigns a trust score of 0 out of 100, and the domain has been blocked by PhishDestroy, confirming its malicious classification across multiple security platforms. These signals collectively reinforce the high‑risk posture and justify continued monitoring.

Defenders should immediately block both the domain j39b.vip and its resolving IP address 154.39.104.142 at network perimeters and DNS filtering layers. Security teams are advised to incorporate the domain into threat intelligence feeds and update URL filtering policies to prevent user access. Continuous monitoring for any additional infrastructure or payload changes is recommended, as the current intelligence does not reveal further malicious components beyond the impersonation page.

VirusTotal
VirusTotal
19 det.
CF Radar
Malicious
TLS Certificate
Expired or unverified -1461d
Age
3 mo
Observed status
Unverified
PhishDestroy
DestroyList
Listed

Data Coverage

VirusTotal 19 / 91 URLQuery not checked PhishStats not checked OTX no community references CF Radar provider verdict: malicious URLScan capture stored report URLScan verdict malicious DNS blocks not checked TLS Expired or unverified WHOIS 3 mo old Screenshot 2 captures · 2 sources Redirect chain not probed
Network Security Intelligence
CF Cloudflare Radar Verdict Malicious
Phishing
View full Cloudflare Radar report

Threat Response Pipeline

Discovery
Checks
Reports
Availability
11/13

Blocklist coverage

10 monitored external feeds · stored snapshot Aug 13, 2026

PhishDestroy Source dataset
10 monitored external feeds No match
MetaMask No match ScamSniffer No match Polkadot No match CryptoFirewall No match OpenPhish No match SEAL No match Enkrypt No match Phishunt No match Codeesura No match DiscordPhishing No match

Stored Capture

URLScan capture 2 / 2
View Full Size Download
Page Title
welcome-BET365
TLS Certificate
Expired or unverified · Issued by Default Company Ltd

Domain Intelligence

Domain
URLScan Verdict Malicious score 100 Phishing brand: bet365 report ↗
Server / ASN Nginx · AS18186 NEBULA-GLOBAL - Nebula Global LLC, US
IP Reputation IP abuse confidence 0/100 0 reports checked Aug 12, 2026
Registrar Gname SG(SG)
Abuse contactcomplaint@gname.com, abuse@gainet.com
ICANN RegistryOfficial ICANN accredited-registrars →
WHOIS LookupICANN RDAP for j39b.vip →
IP Address 154.39.104.142 CN
GeoCN Zhengzhou, CN
NetworkAS18186 · AS4837 CHINA UNICOM China169 Backbone
Reverse IPviewdns.info → rapiddns.io →
RegistrationCreated May 4, 2026 (101d) — Expires May 4, 2027
Elapsed Since First Report 15h
What we count Raw elapsed time since the first stored abuse report. It is not a registrar response-time measurement. Latest observed status: Unverified.
What each report contains Stored outgoing-report records may reference evidence available at the time, such as vendor verdicts, registration data, hosting details, classifications, or screenshots. This page does not infer the exact payload delivered, receipt, acknowledgement, or action by a recipient.
Technical detailsDNS, TLS names and timestamps
First DetectedJun 2, 2026
DOM Analysisanalyzed Jun 11, 2026DOM analysis score 88/100
Submitted URLhttp://j39b.vip/
Nameserversns1.1111343.comns1.dnsbm.comns2.1111343.comns2.dnsbm.comns3.1111343.comns4.1111343.com
TLS fingerprint
TLS observationvalid from Aug 13, 2021scanned Jun 11, 2026
ICANN OVERSIGHT

Accreditation and RAA context

Registrar accreditation and DNS abuse obligations

For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.

Accreditation is a contract, not a safety certification.

RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.

Accreditation is a contract, not a safety seal. Verify ICANN fees Read RAA §3.18 PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Accountability draft Nothing is sent automatically.
Report This Domain Submit evidence & help protect others

VirusTotal Analysis

19 / 91 security vendors flagged this domain
View on VT
Last analyzed Previous stored snapshot: 22 detections
ADMINUSLabs
alphaMountain.ai
BitDefender
Chong Lua Dao
Cluster25
CRDF
CyRadar
ESET
Forcepoint ThreatSeeker
Fortinet
G-Data
Kaspersky
LevelBlue
Lionic
MalwareURL
SOCRadar
Sophos
VIPRE
Webroot

Were You Affected by This Site?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

Europol
Find the official reporting channel for your EU country
National police directory
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory
Template-based draft • optional AI wording assistance requires separate consent Review and submit it yourself

Check Any Domain

Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence

Scan Now

Report Phishing

Submit suspicious domains to our threat database — protect the community

Report

Live Threat Feed

Recent phishing reports and observed availability changes

Monitor

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing

External tools

ChainPatrol URLQuery Google Safe Browsing SSL Labs Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory
HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html 
<iframe
  src="https://phishdestroy.io/embed/domain/j39b.vip"
  title="PhishDestroy threat report for j39b.vip"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>

A Very Sincere Thank-You Note

Satirical draft generator

Recipient
Fee context

Satirical draft. Fee figures are estimates; exact attribution to this domain is not claimed.