betwool[.]com

Analysis of betwool.com indicates that the domain is currently offline but was actively used for brand impersonation targeting Cloudflare. The site was registered on February 21, 2026 through MAT BAO CORPORATION and immediately pointed to the IP address 172.67.195.22, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution employed Cloudflare‑owned nameservers (ariadne.ns.cloudflare.com and yichun.ns.cloudflare.com), and the TLS certificate presented was issued by Google Trust Services under the WE1 hierarchy, consistent with legitimate Cloudflare services. The HTTP response returned a 403 status code, and the page title captured as "Suspected phishing site | Cloudflare" directly references the targeted brand.

VirusTotal records show that two of ninety‑five security vendors flagged the domain, and it appears on a single security blocklist. PhishDestroy has also listed the domain as blocked. Additional security metrics are poor: Gridinsoft assigned a trust score of 0 out of 100, and the detected technology stack is limited to Cloudflare infrastructure.

The intelligence tags the campaign as a crypto‑gambling scam, though the exact content of the site remains unverified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and correlate any traffic to the associated IP with existing threat‑intel feeds. Further analysis is required to confirm the full payload or phishing workflow, but current evidence supports the classification of betwool.com as a malicious impersonation of Cloudflare.