3658sora458200[.]cc

Analysis indicates that the domain 3658sora458200.cc is actively serving HTTP responses with status code 200 and presents a page title of “bet365”. The site is classified as a brand‑impersonation scam targeting Bet365, as indicated by the declared brand target and the matching page title. Infrastructure observation shows the domain resolves to the IPv4 address 40.81.18.27. The address currently appears on one public security blocklist and the domain has been flagged by PhishDestroy, which continues to list it as active. VirusTotal scans have recorded detections from 17 of 91 security vendors, confirming malicious reputation across multiple engines. No additional hosting or ASN information is available from the provided data. The presence of an active HTTP service combined with a high‑confidence brand‑impersonation label suggests the site is likely being used to harvest credentials or redirect victims to malicious content. Defenders should block the domain at DNS and firewall layers, monitor outbound traffic for connections to 40.81.18.27, and update intrusion‑prevention signatures to include the observed indicators. Continuous re‑evaluation is advised, as the site remains active and may evolve its payload or tactics.