bet36566[.]vip

This domain is flagged as an elevated-risk brand impersonation threat targeting Bet365, a well-known online gambling platform. Analysis indicates the site was designed to deceive users into entering credentials or financial details under the pretense of legitimate Bet365 services, as evidenced by the page title '欢迎' (Welcome) and the domain name's close resemblance to the official brand. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Go France Domains Inc, a registrar frequently associated with high-risk domains. It resolves to the IP address 156.234.227.174, hosted under AS138415 (Yancy Limited) in Hong Kong, a network segment with a history of facilitating phishing campaigns. The domain is currently offline but was previously detected by 19 out of 95 security vendors on VirusTotal, appears on one security blocklist, and was blocked by PhishDestroy. The SSL certificate, issued by Let's Encrypt (serial number E8), provides minimal encryption but does not validate legitimacy. Mitigation steps for this threat include immediate blacklisting of the domain and associated IP in enterprise security systems. Network administrators should monitor for connections to 156.234.227.174 and alert users who may have interacted with the site. Organizations should also implement domain-based authentication protocols (e.g., DMARC, SPF, DKIM) to prevent similar spoofing attempts. Users who accessed the site should reset credentials for Bet365 and related financial accounts, while security teams should conduct retrospective analysis for any unauthorized access attempts linked to this campaign.