pebeto[.]com

Analysis of pebeto.com indicates the site has been taken offline but its historical footprint aligns with a crypto‑focused phishing operation. The domain was registered on 10 September 2025 through Web Commerce Communications Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.133.113 located in the United States. The authoritative nameservers are isla.ns.cloudflare.com and jerome.ns.cloudflare.com, and no TLS certificate was observed, confirming the lack of HTTPS protection. The page title retrieved from cached data reads “Pebeto: Most Popular Online Crypto Casino Based on Blockchain”, which matches the “Crypto Scam” classification assigned by the intelligence feed.

The site employed the publicly‑available “Gambler Scam” phishing kit, a toolkit commonly used to harvest credentials for crypto‑related services. Reputation scoring from Gridinsoft assigned a trust score of 1/100, indicating extreme maliciousness. The domain is listed on a single security blocklist and was blocked by the PhishDestroy service. VirusTotal analysis shows six of ninety‑five scanners flagged the domain, reinforcing the malicious assessment.

The combination of a low trust score, presence on a blocklist, detection by multiple AV engines, and use of a known gambling‑themed phishing kit provides strong evidence that pebeto.com was operated as a crypto‑draining scam. Because the site is currently offline, active mitigation is limited to updating blocklists and ensuring that any cached URLs are purged from internal security tools. Defenders should add the domain and its associated IP address to deny‑list rules, monitor for any future re‑registration of the same name or similar variations, and consider sharing the indicator set with threat‑sharing communities. Attribution beyond the registrar and hosting provider remains unknown; no evidence of the underlying threat actor has been identified.