bet63ss[.]com

The domain bet63ss.com has been identified as a brand impersonation threat specifically targeting Bet365, a recognized online gambling platform. Analysis confirms the domain is currently offline, though it previously hosted content designed to deceive users into believing it was the legitimate Bet365 website. The threat type is classified as brand impersonation with an elevated risk level, primarily aimed at credential theft or fraudulent transactions. Technical indicators reveal the domain was flagged by 20 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through NameSilo, LLC on March 27, 2020, and resolved to the IP address 216.118.239.164, hosted under AS45753 (Netsec Limited) in Hong Kong. The domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate was issued by Google Trust Services (WE1), a detail often exploited by threat actors to lend false legitimacy to malicious sites. The page title, '365英国上市官网,' directly mimics Bet365’s branding, further corroborating its impersonation intent. Current status confirms the domain has been taken offline, reducing immediate risk to end users. However, infrastructure analysis reveals the hosting provider and registrar have historically been associated with malicious activity, suggesting potential for re-emergence under a similar or altered domain. Organizations and individuals are advised to block the domain and its associated IP (216.118.239.164) at the network level. End users should verify the authenticity of any Bet365-related communications by cross-referencing official domains and enabling multi-factor authentication on accounts. Security teams are recommended to monitor for new registrations under the same registrar or hosting provider, as threat actors may reuse infrastructure for future campaigns.