bet63qq[.]com

This domain is flagged for elevated-risk brand impersonation, specifically targeting Bet365, a recognized online gambling platform. The threat involves fraudulent replication of the legitimate Bet365 brand to deceive users into disclosing credentials or financial information under false pretenses. Analysis of the domain’s infrastructure and historical behavior confirms its malicious intent, aligning with known patterns of credential harvesting and financial fraud campaigns. Infrastructure analysis reveals the following technical indicators: the domain bet63qq.com is registered through NameSilo, LLC, with a creation date of March 27, 2020. It resolves to the IP address 216.118.239.164, hosted in Hong Kong under AS45753 (Netsec Limited). The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by 17 out of 95 security vendors on VirusTotal. The page title, '365英国上市官网,' directly mimics Bet365’s branding, reinforcing the impersonation tactic. The SSL certificate is issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy, often exploited in phishing campaigns to appear trustworthy. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (216.118.239.164) at the network perimeter. Organizations should update security controls to flag or quarantine emails containing links to bet63qq.com or referencing the page title '365英国上市官网.' End users should be educated on recognizing brand impersonation tactics, particularly in sectors like online gambling, where financial transactions are frequent. Monitoring for similar domains registered through NameSilo or resolving to the same IP range (216.118.239.0/24) can help preemptively identify related threats. If the domain resurfaces, security teams should treat it as an active credential theft risk and prioritize takedown requests through registrar channels.