bet365h13[.]com

Analysis of bet365h13.com indicates a high‑risk brand‑impersonation operation targeting Bet365 customers with a crypto gambling scheme. The domain was registered through Dynadot LLC on October 24, 2025 and resolves to the IPv4 address 34.96.219.82, which is hosted in Hong Kong and assigned to AS396982 Google LLC. Both authoritative nameservers, rocky.ns.cloudflare.com and tegan.ns.cloudflare.com, belong to Cloudflare, a common choice for fast‑deployment malicious sites. No TLS certificate was presented, leaving the site exposed to clear‑text interception and confirming the absence of legitimate security controls. The page title returned by the HTTP response is simply "bet365," matching the advertised brand and reinforcing the impersonation claim. VirusTotal scans show that sixteen of ninety‑five security vendors flagged the domain, providing multi‑engine corroboration of malicious intent.

Google Safe Browsing has classified the URL as a social engineering threat, and the domain appears on at least one external security blocklist. AlienVault OTX references the domain in three distinct threat intelligence pulses, further indicating analyst consensus on its illicit nature. Scamadviser assigns a trust score of 1 / 100, reflecting extreme unreliability. The site was actively taken down and is currently offline, but PhishDestroy maintains a block record, suggesting that residual infrastructure may persist.

Defenders should immediately block traffic to 34.96.219.82 and add bet365h13.com to domain‑based deny lists across perimeter and endpoint controls. Monitoring for newly registered domains using the same registrar, similar Cloudflare nameservers, or the same IP subnet can help surface copycat operations. Continuous updates to threat‑intel feeds are recommended to capture any re‑hosting attempts or shifts to alternative hosting providers. The combination of multi‑vendor detections, reputable blocklists, and brand impersonation evidence makes bet365h13.