365756amylzz[.]com

Analysis of the domain 365756amylzz.com indicates it was actively used for brand impersonation targeting Bet365, a recognized online gambling platform. The domain was registered on June 6, 2025, through GoDaddy.com, LLC, and resolved to the IP address 27.124.41.82, hosted by CTG Server Limited (AS152194) in Hong Kong. Nameservers daniella.ns.cloudflare.com and tate.ns.cloudflare.com were configured, suggesting Cloudflare infrastructure was employed. The SSL certificate was issued by Asseco Data Systems S.A. under the Certum DV TLS G2 R39 CA, a common choice for phishing sites leveraging legitimate-looking encryption. The page title captured during analysis was 'BET365,' directly matching the targeted brand, and the domain was flagged by 14 of 91 security vendors on VirusTotal, indicating moderate detection coverage.

It appeared on at least one security blocklist and was blocked by PhishDestroy. Technology stack analysis revealed the use of Windows Server, IIS, jQuery, CNZZ, and Baidu Analytics (百度统计), which are consistent with phishing infrastructure observed in prior brand impersonation campaigns. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as malicious. As of July 24, 2026, the domain is offline, though its prior infrastructure remains documented.

Defenders should treat any future resolution of this domain as suspicious and prioritize blocking or monitoring its activity. The combination of Cloudflare nameservers, Hong Kong-based hosting, and analytics tools commonly used in Chinese cybercrime ecosystems suggests a coordinated effort to evade detection. No evidence of a specific phishing kit or payload was provided, so further forensic analysis would be required to determine the exact attack vector. Organizations should review logs for connections to 27.124.41.82 or related subdomains and assess potential exposure to this campaign.