b45062[.]com

Analysis of b45062.com, which was taken offline as of the report date, confirms a targeted brand impersonation campaign against Bet365. The domain was registered through NameSilo, LLC on July 13, 2023 and resolves to IP address 206.119.83.71, an address belonging to AS140227 Hong Kong Communications International Co., Limited in Hong Kong. DNS resolution is served by the Cloudflare nameservers decker.ns.cloudflare.com and mckenzie.ns.cloudflare.com, but the site lacks an SSL certificate, indicating unencrypted HTTP access. The page title returned by the server, "bet365西京上市官网," directly references the Bet365 brand, reinforcing the impersonation intent.

Security telemetry shows the domain appears on a single security blocklist and is blocked by PhishDestroy. VirusTotal scans reported 16 of 95 scanners flagging the domain as malicious, and AlienVault OTX lists the domain in 17 threat intelligence pulses, suggesting moderate detection activity across the community. Reputation services assign extremely low trust scores: Gridinsoft rates the site 0/100 and Scamadviser 1/100, reflecting high confidence in its malicious nature. While the site is currently offline, defenders should continue to monitor for any reactivation or related infrastructure reuse.

Recommended actions include adding the domain and its IP address to internal deny lists, updating intrusion detection signatures to flag DNS queries to the listed Cloudflare nameservers for this FQDN, and reviewing outbound traffic for connections to the Hong Kong hosting AS. Organizations using Bet365 credentials should alert users to the impersonation attempt and reinforce credential hygiene. The limited public exposure—no SSL, single blocklist entry, and modest VirusTotal detection—leaves open the possibility of a short-lived campaign, but the combination of brand-specific page title, low trust scores, and multiple intelligence sources warrants elevated vigilance.