j93o[.]vip

The domain j93o.vip was registered on June 18, 2026 through NameMart Pte. Ltd. and is currently resolved to the IPv4 address 103.27.177.163, which is allocated to Kowloon Telecommunications Co., Ltd. in Hong Kong. The authoritative name servers for the zone are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com. The site presents a TLS certificate issued by Let’s Encrypt, indicating that HTTPS is enforced, and the server advertises HTTP/3 support, HSTS, and a Cloudflare front‑end. Underlying web technology fingerprints include Nginx as the web server and Vue.js as the client‑side framework.

The page title returned from the HTTP response is "welcome-BET365", directly referencing the betting brand Bet365, which aligns with the reported scam type of brand impersonation. VirusTotal has recorded 8 detections out of 91 scanned security vendors, and the domain is listed on at least one public blocklist maintained by PhishDestroy. The domain is flagged as high‑risk and remains active as of the report date, July 22, 2026. No public malware samples, phishing page screenshots, or victim reports have been released, so the exact payload or credential‑harvesting mechanisms are not yet confirmed.

However, the combination of a recent registration, brand‑specific page title, multiple vendor detections, and inclusion on a phishing blocklist provides a strong indicator of malicious intent. Defensive teams should add j93o.vip to URL filtering and DNS block lists, monitor outbound connections to the associated IP range, and enforce strict TLS inspection policies to detect any credential submission. Continuous re‑scanning of the domain with sandbox and URL reputation services is advised to capture any evolution of the payload. Organizations that use Bet365 services should educate users about the risk of unsolicited login prompts and advise verification of the legitimate Bet365 domain before entering credentials.