j39b[.]vip

Analysis of the domain j39b.vip indicates an active high‑risk brand‑impersonation campaign targeting Bet365. The domain was registered on May 04, 2026 through Gname.com Pte. Ltd. and serves a page titled "welcome-BET365" with an HTTP 200 response. The site presents a default SSL certificate issued to Default Company Ltd, suggesting the certificate was not specifically obtained for the fraudulent operation. The page title directly mirrors the legitimate brand, reinforcing the impersonation intent.

Infrastructure examination shows that j39b.vip resolves to IP address 154.39.104.142, which is assigned to AS4837 CHINA UNICOM China169 Backbone and geolocated to China. The domain utilizes a set of six nameservers: ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and ns4. These nameservers are commonly observed in other malicious hosting configurations, indicating possible reuse of compromised or rented DNS services. The IP and DNS footprint are consistent with previously observed Chinese‑based phishing infrastructure.

Detection metrics reveal that VirusTotal has flagged the domain in 22 out of 95 security vendor scans, and the domain appears on one public blocklist. Gridinsoft assigns a trust score of 0 out of 100, and the domain has been blocked by PhishDestroy, confirming its malicious classification across multiple security platforms. These signals collectively reinforce the high‑risk posture and justify continued monitoring.

Defenders should immediately block both the domain j39b.vip and its resolving IP address 154.39.104.142 at network perimeters and DNS filtering layers. Security teams are advised to incorporate the domain into threat intelligence feeds and update URL filtering policies to prevent user access. Continuous monitoring for any additional infrastructure or payload changes is recommended, as the current intelligence does not reveal further malicious components beyond the impersonation page.