m1665[.]com

PhishDestroy first observed m1665.com on Feb 26, 2026. Stored content metadata identifies Bet365 as the apparent target. Current evidence score: 95/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, DNS security resolvers, Cloudflare Radar, and URLScan. VirusTotal recorded 19 detections among 93 engines: ADMINUSLabs, alphaMountain.ai, Cluster25, CRDF, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky, Lionic, MalwareURL, Netcraft, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Feb 25, 2026 at 00:04 UTC. DNS security checks returned 2 blocking results across 14 tested policies: Cloudflare Family, Cloudflare Security; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to bet365 and assigned phishing as its category on Jul 29, 2026 at 03:16 UTC. Non-positive and contextual checks: AlienVault OTX listed 2 community pulse references (not vendor detections) on Mar 1, 2026 at 01:05 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:48 UTC. PhishStats returned no feed match on Mar 1, 2026 at 09:01 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:19 UTC; content was unavailable. Registration records for the domain list GoDaddy.com, LLC as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 103.143.28.212 on AS135581 (ONL-HK-AS 19 Chun Wang Street, Tseung Kwan O Industrial Estate, N.T. Hong Kong, HK). The IP and ASN identify shared CDN edge infrastructure; the origin server is not established by this address. The stored server header is nginx. DOM analysis on Jul 29, 2026 at 04:09 UTC returned 78/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Default Company Ltd as the certificate issuer; checked Mar 15, 2026 at 08:10 UTC.

The content indicators and 4 positive source findings support the current Bet365 impersonation and phishing classification. The target field identifies Bet365, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.