bet365h7[.]net

Analysis of the domain bet365h7.net indicates it was actively impersonating the Bet365 brand as part of a crypto gambling scam. The domain, registered on September 20, 2025, through Dynadot LLC, resolved to 172.67.202.25 (AS13335 Cloudflare, Inc., US) and used Cloudflare nameservers rocky.ns.cloudflare.com and tegan.ns.cloudflare.com. No SSL certificate was present. The page title, 'bet365-上网导航,' suggests a Chinese-language interface targeting Bet365 users, though the exact content and functionality remain unconfirmed due to the domain's offline status as of July 23, 2026. Detection data reveals elevated risk: Scamadviser assigned a trust score of 1/100, and the domain appeared in 17 AlienVault OTX threat intelligence pulses.

Fourteen of the security vendors scanning the domain on VirusTotal flagged it as malicious. It was blocked by PhishDestroy and listed on one additional security blocklist. The domain's infrastructure, including Cloudflare hosting, aligns with common phishing and scam operations, though no specific phishing kit or additional technical artifacts have been publicly documented. Defenders should treat this domain as confirmed malicious infrastructure.

Blocklist the domain and its resolved IP at perimeter security controls. Investigate logs for connections to 172.67.202.25 or the domain name, particularly from users who may have interacted with gambling or crypto-related content. Given the domain's offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential incident response. No evidence suggests this domain is part of a broader campaign, but defenders should monitor for related domains registered through Dynadot or using similar Cloudflare-hosted infrastructure.