j72q[.]vip

This domain, j72q.vip, is flagged as a brand impersonation threat specifically targeting Bet365, a well-known online betting platform. Analysis indicates the site was designed to mimic the legitimate Bet365 interface, likely to harvest user credentials or financial information. The page title, 'welcome-BET365,' further confirms the intent to deceive users into believing they are interacting with the authentic Bet365 service. No direct evidence of a drainer kit was observed, but the use of Vue.js and GeeTest suggests dynamic content delivery and potential anti-bot or CAPTCHA mechanisms to evade detection. Infrastructure analysis reveals the domain was registered on May 27, 2026, through NameMart Pte. Ltd., an uncommon registrar for legitimate betting services. It resolves to the IP address 154.39.104.128, which has been associated with other malicious activities. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, indicating moderate consensus on its threat status. The domain appears on one security blocklist, and Google Safe Browsing (GSB) has not yet classified it, though this may reflect a lag in propagation rather than legitimacy. Technologies detected include Nginx as the web server, Vue.js for frontend rendering, and GeeTest, which is often used for bot mitigation in fraudulent schemes. As of the latest assessment, j72q.vip has been taken offline, reducing immediate exposure to end users. However, the infrastructure remains a latent risk, as the domain could be reactivated or repurposed for future campaigns. Organizations are advised to monitor for residual DNS queries or cached references to the domain. Users who may have interacted with the site should reset credentials for Bet365 and any other services where identical passwords were reused. The elevated risk level is retained due to the domain's recent creation, targeted brand impersonation, and the use of evasion techniques.