3011662[.]com

The domain 3011662.com was registered on February 21, 2026 through GoDaddy.com, LLC and is currently listed as taken offline. It resolves to the IP address 103.86.46.165, which is registered to MOACK.Co.LTD in South Korea and is announced by ASN 138195. The host infrastructure employs a stack that includes Nginx, OpenResty, Amazon Web Services, Amazon CloudFront, and Vue.js, and the site is served over HTTPS with a Let’s Encrypt R13 certificate. The page title returned from the HTTP response is "Bet365 - 官方直营", directly referencing the Bet365 brand, confirming that the domain is being used to impersonate that online gambling service. Threat intel sources flag the domain as a crypto‑gambling scam; it appears on one security blocklist and has been blocked by PhishDestroy.

Reputation scoring from Gridinsoft assigns a zero‑out‑of‑one‑hundred trust rating. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, indicating a moderate level of detection across antivirus vendors. AlienVault OTX lists the domain in a single pulse, further corroborating its malicious classification. Nameserver records point to Cloudflare (henry.ns.cloudflare.com and jade.ns.cloudflare.com), a common choice for fast content delivery but also frequently abused for malicious hosting.

While the site is currently offline, the observed infrastructure—particularly the combination of a Korean‑based IP, low trust score, and multiple vendor detections—suggests a deliberate attempt to lure Bet365 customers into a cryptocurrency‑based gambling fraud. Defenders should add 3011662.com to URL filtering and domain block lists, monitor for any re‑activation of the domain or similar patterns in DNS queries, and enforce strict verification of Bet365‑related communications. Incident response teams should also consider correlating traffic to the associated IP range (AS138195) with internal logs to detect any prior exposure.