bet401[.]cc

This domain, bet401.cc, operates as a brand impersonation threat targeting Bet365, a well-known online betting platform. Analysis indicates the domain presents a fraudulent login interface under the page title 'bet365,' designed to deceive users into submitting account credentials. The infrastructure is configured to mimic legitimate betting portals, increasing the likelihood of successful credential theft from unsuspecting victims seeking to access their accounts or place wagers. Infrastructure analysis reveals the domain was registered on November 11, 2025, through GoDaddy.com, LLC, and resolves to the IP address 122.10.20.121, located in Hong Kong under autonomous system AS134548 (DXTL Tseung Kwan O Service). Detection metrics show the domain is flagged by 18 out of 95 security vendors on VirusTotal, while two independent blocklists—PhishDestroy and PhishingDB—have listed it as malicious. The absence of an SSL certificate further undermines the domain’s legitimacy, as modern secure connections are a baseline expectation for financial and betting platforms. Users who accessed bet401.cc should immediately revoke any entered credentials and enable multi-factor authentication on their legitimate Bet365 accounts. Financial activity should be monitored for unauthorized transactions, and password resets should be performed on any accounts where identical credentials may have been reused. System scans for malware are recommended, as phishing pages may deploy additional payloads. Organizations should update their web filtering rules to block the domain and its associated IP address to prevent further exposure.