bet365w[.]app

Analysis of bet365w.app, observed as offline at the time of the July 23 2026 assessment, shows multiple indicators of a high‑risk brand‑impersonation operation targeting the Bet365 brand. The domain was registered on 9 May 2025 and is hosted on a Google Cloud IP address (34.96.219.82) located in Hong Kong, belonging to ASN 396982 (Google LLC). The registrar entry lists GOOGL-2 as the upstream provider, and the authoritative name servers are rocky.ns.cloudflare.com and tegan.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. No TLS certificate is presented, confirming the absence of HTTPS protection. The site’s page title is simply "bet365", matching the target brand, and the listed scam type is "Crypto Gambling".

Google Safe Browsing classifies the URL under social‑engineering threats, and the domain appears on one public blocklist as well as being flagged by PhishDestroy. AlienVault OTX has incorporated the domain in two separate threat‑intel pulses, indicating that it has been observed in multiple malicious contexts. VirusTotal records 16 of 95 scanning engines as positive detections, reinforcing the malicious reputation. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1/100 and Gridinsoft 0/100, both reflecting a near‑certain malicious intent.

The combination of brand impersonation, crypto‑gambling lure, lack of encryption, and multiple independent detections suggests a coordinated attempt to defraud users seeking Bet365 services. Uncertainty remains regarding the current content of the site, as it is offline and no screenshots or HTML have been captured. Defenders should block the domain at network perimeter, update intrusion‑prevention signatures with the observed IP and name‑server data, and monitor for any future re‑activation. Ongoing threat‑intel feeds should be consulted for new indicators, and any internal logs showing connections to 34.96.219.82 should be investigated for potential compromise.