3656534[.]cc

This domain, 3656534.cc, is flagged for brand impersonation targeting Bet365, a well-known online gambling platform. Analysis indicates the domain was designed to mimic the legitimate Bet365 brand, likely to deceive users into divulging sensitive account credentials or financial information. No evidence of a crypto drainer kit or direct malware deployment was observed, but the page title '欢迎光临' (translated as 'Welcome') suggests an attempt to create a localized, seemingly legitimate user experience for Chinese-speaking victims. Infrastructure analysis reveals the domain was registered on May 21, 2024, through GoDaddy.com, LLC. It resolves to the IP address 54.178.111.163, hosted on Amazon.com, Inc. infrastructure (AS16509) in Japan. As of the latest assessment, the domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal. The domain is not currently listed on Google Safe Browsing (GSB), though this status may change as additional telemetry is processed. The combination of a recent registration date, low blocklist prevalence, and targeted brand impersonation aligns with typical phishing campaign tactics. The domain has since been taken offline, reducing immediate exposure risk to end users. However, the infrastructure remains a potential vector for future malicious activity, particularly if the threat actor reuses the same hosting provider or registrar for subsequent campaigns. Organizations are advised to monitor for residual DNS caching or proxy-based access attempts. Users who may have interacted with the domain should reset credentials for any associated accounts, particularly those tied to Bet365 or financial services. Continued vigilance is recommended, as threat actors often rotate domains and IPs to evade detection.