ts67866[.]com

Analysis of ts67866.com indicates a brand impersonation infrastructure targeting Bet365, assessed as an elevated-risk phishing endpoint. The domain presents characteristics consistent with credential harvesting campaigns, including imitation of legitimate betting service branding and a page title matching “bet365”. The observed behavior suggests a cloned authentication or landing interface designed to capture user credentials.

Technical telemetry attributes the domain to a registration via GoDaddy.com, LLC, with creation timestamp recorded as March 10, 2026. Infrastructure resolution points to IP 20.2.172.139, geolocated in Hong Kong under AS8075 Microsoft Corporation. TLS configuration uses a Sectigo Limited certificate, specifically Sectigo Public Server Authentication CA DV R36. The domain appears on 1 security blocklist and is blocked by PhishDestroy. Multi-engine detection reports a VirusTotal score of 21/95 security vendors flagging the domain.

Current status indicates the domain is offline following takedown actions, reducing immediate exposure; however, historical resolution data confirms prior malicious hosting activity. The combination of brand impersonation of Bet365, a relatively recent creation date, and multi-vendor detection coverage (21/95) suggests a coordinated phishing campaign lifecycle. Despite removal from active resolution, residual risk persists through potential redeployment on alternate infrastructure or reuse of the domain for future lures. Continued monitoring of related IP space 20.2.172.139 and certificate issuance patterns is recommended for attribution and early detection.