6365-56[.]com

6365-56.com is a high-risk domain currently active in impersonating the popular betting and gaming brand Bet365. The domain was registered on April 12, 2025, through Gname.com Pte. Ltd., and it resolves to the IP address 45.126.181.45, which is located in Hong Kong and associated with AS59371 Dimension Network & Communication Limited. Analysis indicates that the domain is being used for a brand impersonation scam, which poses a significant threat to users who may be misled into believing they are interacting with the legitimate Bet365 website. The page title of the site is 'My Blog - My WordPress Blog,' which does not align with the typical content expected from a Bet365 impersonation site, suggesting that the attackers may be using this title to avoid immediate detection or as a placeholder for further development. The domain is flagged by 14 out of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious nature. Additionally, the domain has been mentioned in 16 threat intelligence pulses on AlienVault OTX, highlighting its widespread recognition as a threat. Defenders should take immediate action to block this domain and educate users about the risks of Bet365 impersonation scams. Given the high risk level and the domain's presence on multiple blocklists, it is advisable to monitor for any attempts by the attackers to expand their infrastructure or change the content of the site. The SSL certificate, issued by Let's Encrypt, does not provide any assurance of the site's legitimacy, as it is common for phishing sites to use valid SSL certificates to appear more trustworthy. Security teams should also consider implementing additional layers of protection, such as domain monitoring and user education, to prevent potential compromises.