bet9655[.]com

bet9655.com is currently active and returns an HTTP 307 redirect, indicating that visitors are being sent to another location, a common technique used by phishing operators to hide the final landing page. The domain was registered through NameSilo, LLC, and its authoritative name servers are ns7.alidns.com and ns8.alidns.com, both of which belong to the Alibaba Cloud DNS service, a popular hosting platform for malicious infrastructure. The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one trusted threat intelligence source has classified it as malicious.

VirusTotal scans have resulted in seven positive detections out of ninety‑one antivirus and URL‑reputation engines, providing independent corroboration of its malicious nature. No additional intelligence such as Safe Browsing, OTX, or SSL certificate details is presently available, and the IP address and geographic origin have not been disclosed in the supplied data. Because the site is still reachable, defenders should assume that it may be used to harvest credentials or deliver further payloads.

Recommended mitigation steps include adding bet9655.com to internal blocklists, updating firewall and proxy deny rules, and ensuring that endpoint web‑filtering products ingest the PhishDestroy feed and the observed VirusTotal detections. Continuous monitoring of the domain’s DNS records and any changes to its HTTP response code is advised, as attackers frequently switch hosting providers or modify redirects to evade detection. Incident response teams should also scan outbound traffic for connections to the identified nameservers and consider issuing a network‑wide advisory to users warning them not to interact with any login prompts or payment pages that reference bet9655.com.