codebonusbet365[.]club

This domain is flagged for elevated-risk brand impersonation, specifically targeting Bet365, a well-known online betting platform. The threat involves fraudulent replication of the brand's official interface to deceive users into submitting credentials or financial details under false pretenses. Analysis indicates the domain was designed to exploit trust in the Bet365 name, leveraging social engineering tactics to bypass user vigilance. Infrastructure analysis reveals the domain codebonusbet365.club was registered on September 12, 2025, through Dynadot Inc. It resolved to IP address 104.21.61.250, hosted on Cloudflare's network (AS13335). The SSL certificate was issued by Google Trust Services (WE1), a common tactic to lend legitimacy to malicious sites. At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appeared on one security blocklist and was subsequently taken offline. The page title, 'code bonus bet365,' further confirms the intent to mimic promotional or bonus-related content associated with the legitimate brand. Mitigation for this type of threat involves immediate domain blocking at the network level, particularly for endpoints accessing financial or betting-related services. Organizations should update web filtering rules to include the domain and its resolved IP address (104.21.61.250) in denylists. Users who may have interacted with the domain should be instructed to reset credentials for Bet365 and any associated financial accounts, as well as monitor for unauthorized transactions. Security teams should conduct retrospective log analysis to identify any prior connections to the domain or IP, particularly from high-risk user groups. Given the use of Cloudflare infrastructure, additional scrutiny of domains leveraging similar hosting patterns is recommended to preemptively identify related threats.