account.cupricclumbers.com is an impersonation phishing page posing as the betting brand Bet365. It presents itself to Chinese-speaking users as an official sportsbook. The "account" subdomain is built to look like a login or account portal. PhishDestroy first flagged it on 2026-10-13, and it was still live and serving content on 2026-10-19.
How the scam works
The page title reads "中国·best365英国在线体育(股份)有限公司-Official website", which claims to be the official site of a UK online sports betting company. It uses the misspelling "best365" to borrow Bet365's reputation. Fake sportsbooks like this usually ask visitors to sign in or register, which captures their usernames and passwords. They then push victims to deposit money into an account that looks real but cannot be withdrawn from. When a victim asks for a payout, these operations commonly invent taxes, verification charges or "unlock" fees to extract more money before the victim gives up.
Evidence
On 2026-10-13, 8 of 92 VirusTotal engines flagged the domain: BitDefender, CRDF, Fortinet, G-Data, Gridinsoft, Seclookup, SOCRadar and Sophos. That is a minority of engines, but eight independent vendors agreeing is a meaningful signal for a site this new. urlscan.io rated the page malicious and detected the bet365 brand on it, which independently confirms the impersonation. The domain is listed on the PhishDestroy blocklist.
Infrastructure
The domain was registered on 2026-01-24 through Metaregistrar BV, nearly nine months before PhishDestroy detected it. That long gap suggests the domain was registered well in advance rather than spun up for a single burst of activity. The site is hosted in the United States on 107.158.150.233, inside AS62904 (Eonix Corporation).
What to do
If you logged in or registered on this site, change that password right away, along with any other account that uses the same one. Then turn on two-factor authentication on your real Bet365 account. If you deposited money, contact your bank or card issuer immediately to dispute the payment. Do not pay any further "withdrawal," tax or verification fee the site demands, because those payments will not release your funds. Security teams should block the domain and its hosting IP and watch for other look-alike "best365" pages. They should also report the site to Bet365's brand-protection team.
Evidence layersAvailability: Content servingContent: Content served at rootDNS: ResolvedRegistration: Unknown
Latest HTTP observationコンテンツ公開中Ordinary HTTP content served90%2026-10-20 10:00:32 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-20 10:00:32 UTClast content: 2026-10-20 10:00:32 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
