bet39099[.]com

This domain, bet39099.com, is identified as a brand impersonation threat targeting Bet365, a well-known online gambling platform. Analysis confirms the site mimics Bet365’s official branding, including localized content for Chinese-speaking users, as evidenced by the page title "Bet365官网:尽享无与伦比的在线博彩体验-Bet365中国." The infrastructure is designed to deceive users into engaging with fraudulent betting services, though no cryptocurrency drainer or credential-harvesting kit has been explicitly linked to this domain at this time. Technical indicators reveal multiple red flags. The domain was registered on May 19, 2026, through NameSilo, LLC, an unusually future-dated creation that may indicate an attempt to evade detection or exploit registration loopholes. It resolves to the IP address 45.205.36.54 and employs technologies such as Node.js, Envoy, Bootstrap, Express, and Google Analytics, suggesting a relatively sophisticated backend. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and Gridinsoft assigns it a trust score of 0/100. The SSL certificate is issued by Let’s Encrypt, a common but not inherently suspicious provider often abused in phishing campaigns. As of the latest assessment, bet39099.com has been taken offline, reducing immediate risk to end users. However, the infrastructure may resurface under a different domain or IP address, a tactic frequently observed in brand impersonation campaigns. Organizations and users are advised to monitor for similar domains registered through NameSilo or resolving to the same IP range. Network defenders should update blocklists to include the domain and associated IP, while users should verify the authenticity of any gambling or betting platform before engaging. The future-dated registration warrants further scrutiny, as it may indicate broader operational security measures by the threat actor.