365kjump[.]cc

This domain, 365kjump.cc, operates as a credential harvesting site targeting users of the legitimate Bet365 platform. The site mimics the official Bet365 interface, presenting a login page with the identical page title 'bet365' to deceive visitors into entering their account credentials. Such impersonation attacks are designed to capture sensitive information, including usernames, passwords, and potentially financial details, which can then be exploited for unauthorized account access or sold on underground markets. The threat extends beyond individual compromise, as stolen credentials may facilitate further fraudulent transactions or identity theft. Analysis indicates this domain was registered on February 20, 2025, through Dynadot LLC, a registrar commonly used for both legitimate and malicious domains. The site resolves to an IP address (34.146.136.33) hosted on Google LLC infrastructure (AS396982) in Japan, a pattern observed in other phishing campaigns leveraging cloud providers to evade detection. At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, with additional listings on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate issued by Let's Encrypt (R13) provides a false sense of security, as encrypted connections do not guarantee legitimacy. The domain has since been taken offline, but similar threats may emerge using comparable tactics. Users who visited 365kjump.cc or entered credentials on the site should assume their account information has been compromised. Immediate steps include changing passwords for the affected Bet365 account and any other platforms where the same credentials were reused. Enable multi-factor authentication (MFA) on all accounts to mitigate unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. If personal or payment information was submitted, consider placing a fraud alert with credit bureaus and reporting the incident to relevant authorities. Organizations should update security blocklists to include this domain and its associated IP address (34.146.136.33) to prevent future access attempts. Vigilance against similar phishing domains is advised, particularly those impersonating financial or gaming platforms.