bet365k[.]bet

On July 23, 2026 analysts observed that the domain bet365k.bet is currently offline but retains indicators of a high‑risk brand‑impersonation operation targeting Bet365. The domain was registered on May 10, 2025 and resolves to the IP address 34.96.219.82, which belongs to Google LLC (ASN 396982) located in Hong Kong. DNS resolution is served by rocky.ns.cloudflare.com and tegan.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative name servers. The site presents a page title of “bet365”, matching the targeted brand, and is classified as a crypto‑gambling scam in the intelligence feed. Multiple security services have flagged the domain.

VirusTotal recorded 17 detections out of 95 scanned scanners, and Google Safe Browsing categorises the URL as social engineering. The domain appears on one external blocklist and has been referenced in two AlienVault OTX pulses. It was blocked by the PhishDestroy sinkhole. Reputation services assign extremely low trust scores: Scamadviser rates it 1 / 100 and Gridinsoft 0 / 100, indicating a high likelihood of malicious intent. No TLS certificate was observed, meaning any attempted connections would occur over plain HTTP.

The evidence points to an infrastructure that leverages legitimate cloud hosting (Google Cloud) and Cloudflare DNS to hide its location while presenting a convincing brand name. Because the site is offline, active exploitation cannot be confirmed, but the combination of brand impersonation, crypto‑gambling classification, and multiple vendor detections suggests a persistent threat actor may reactivate the domain or spawn similar domains. Defenders should add bet365k.bet to network‑level blocklists, monitor DNS queries for the associated IP and name‑servers, and ensure that any user‑initiated connections to the domain are blocked at the firewall or proxy. Continuous threat‑intel feeds should be consulted for re‑appearance of the domain or related indicators.