j5115j[.]com

This domain j5115j.com is currently active and has been identified as a crypto‑gambling impersonation of the Bet365 brand. The site was registered on 20 September 2024 through GoDaddy.com, LLC and resolves to the IPv4 address 103.86.46.165, which is announced by AS138195 (MOACK.Co.LTD) and geolocated to the Republic of Korea. The hosting stack includes Nginx behind Amazon Web Services, with OpenResty, HTTP Strict Transport Security, and Amazon CloudFront CDN; the TLS certificate is issued by Let’s Encrypt (R12). The HTTP response code is 200, indicating the page is reachable. The page title returned by the server is the literal string “bet365”, matching the declared brand target.

Security‑intelligence sources have flagged the domain on one blocklist; it is presently blocked by PhishDestroy. VirusTotal analysis shows that 14 of 93 scanning engines have generated a detection, reinforcing the malicious assessment. AlienVault OTX lists the domain in a single threat‑intel pulse. The Gridinsoft trust score is 0 out of 100, reflecting a very low reputation. Nameserver records point to paityn.ns.cloudflare.com and tate.ns.cloudflare.com, both Cloudflare‑managed.

Given the convergence of brand impersonation, a low trust score, multiple vendor detections, and active blocklist placement, the infrastructure should be treated as high‑risk. Defenders should add the domain and its IP address to outbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and ensure that any traffic to the Let’s Encrypt certificate fingerprint is blocked. Incident response teams should also review logs for any connections to the AS138195 network and consider reporting the activity to the registrar and relevant anti‑phishing coalitions. Continuous re‑scanning is advised, as the threat landscape may evolve.