1511[.]us

On July 23, 2026, the domain 1511.us was observed to be taken offline after being identified as a counterfeit site targeting the Bet365 brand. The registration record shows the domain was created on November 06, 2025 through Dynadot LLC. The page title returned by the server is exactly “bet365”, matching the brand target field. Infrastructure analysis reveals that the domain resolved to the IPv4 address 103.86.46.165, which is allocated to MOACK.Co.LTD in South Korea (AS138195). Both authoritative name servers are hosted by Cloudflare (merlin.ns.cloudflare.com and uma.ns.cloudflare.com). No TLS certificate was presented, indicating the site operated over plain HTTP.

The Gridinsoft trust scoring system assigned a score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans logged 15 detections out of 93 participating vendors, confirming the presence of malicious components. The domain appears on one external blocklist and was flagged by PhishDestroy, reinforcing the classification. An AlienVault OTX pulse references the domain in a single threat‑intelligence feed, providing additional community context.

The listed scam type is “Crypto Gambling”, suggesting the site attempted to lure victims into cryptocurrency‑based wagering schemes under the guise of the legitimate Bet365 service. Because the site is currently offline, active credential harvesting cannot be confirmed, and the exact payload or redirection chain remains unknown. Defenders should continue to block DNS resolution for 1511.us and the associated IP address, add the domain to web‑filter and email‑gateway deny lists, and monitor for any re‑registration attempts. Continuous threat‑intel feeds should be consulted for updates, and any related hashes or URLs observed in network traffic should be investigated.