bet365[.]q636gb4[.]cc

The domain bet365.q636gb4.cc has been identified as a brand impersonation threat targeting Bet365, a well-known online gambling platform. Analysis confirms the domain was actively spoofing the Bet365 brand, presenting an elevated risk to users through deceptive login portals and fraudulent transaction interfaces. The site is currently offline, but prior activity suggests it was designed to harvest credentials or facilitate unauthorized financial transactions under the guise of the legitimate service. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on April 03, 2026, an unusually future-dated creation timestamp that may indicate an attempt to evade detection or obscure registration details. It resolved to the IP address 174.35.102.153 and employed a Let's Encrypt SSL certificate, a common tactic among threat actors to lend a false sense of legitimacy. The domain was flagged by 17 of 95 security vendors on VirusTotal, indicating broad consensus regarding its malicious nature. Additionally, it appeared on one security blocklist and was proactively blocked by at least one threat intelligence feed. Detected technologies included RxJS and Snowplow Analytics, which may have been leveraged to track user interactions or exfiltrate data. As of the latest assessment, bet365.q636gb4.cc has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the domain's registration remains active, and similar impersonation attempts may re-emerge under different aliases. Organizations and users are advised to monitor for related domains, particularly those using alphanumeric subdomains or future-dated registration timestamps. Network-level blocking of the associated IP (174.35.102.153) and implementation of domain reputation checks are recommended to mitigate residual risk. Security teams should also review logs for prior connections to this domain and investigate potential credential exposure among affected users.