bet394[.]cc

This domain, bet394.cc, is flagged as a brand impersonation phishing site specifically targeting Bet365, a well-known online gambling platform. Analysis indicates the site was designed to deceive users into believing they were accessing legitimate Bet365 services, as evidenced by the page title 'bet365' and the domain’s naming convention. No drainer kit signatures were identified in the available telemetry, but the domain’s structure and content align with typical credential harvesting tactics used in phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 122.10.20.121, hosted on AS134548 (DXTL Tseung Kwan O Service) in Hong Kong. It was registered on November 05, 2025, through GoDaddy.com, LLC. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The domain lacks an SSL certificate, further reducing its legitimacy. Google Safe Browsing (GSB) status is not explicitly provided, but the domain’s presence on PhishDestroy’s blocklist corroborates its malicious classification. As of the latest assessment, bet394.cc has been taken offline, likely due to remediation efforts by the registrar or hosting provider following abuse reports. However, the elevated risk persists due to the domain’s recent creation date and the potential for threat actors to re-deploy similar infrastructure. Organizations and users are advised to block the domain at the network level, monitor for related indicators of compromise (IOCs), and implement multi-factor authentication (MFA) to mitigate credential theft risks. Security teams should also investigate logs for any prior connections to 122.10.20.121 or associated domains to identify potential exposure.