rollcoin[.]bet

Analysis as of July 25 2026 indicates that rollcoin.bet is an offline crypto‑casino phishing site. The domain was registered on 5 November 2025 via NiceNIC International Group Co., Limited and resolves to 172.67.213.121, an address belonging to Cloudflare (AS13335) located in the United States. The authoritative nameservers are augustus.ns.cloudflare.com and dana.ns.cloudflare.com, which is consistent with the Cloudflare hosting profile. No TLS certificate is presented, meaning HTTPS connections are not supported, which further hampers legitimate user confidence. The site’s title, “Rollcoin: Most Popular Online Crypto Casino Based on Blockchain,” coupled with the classification of the underlying phishing kit as “Gambler Scam” and the broader designation of a crypto‑scam, suggests the operation attempts to lure victims into a fraudulent cryptocurrency gambling experience.

The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy, indicating that at least one trusted anti‑phishing feed has taken action. Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of reputation. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, providing independent confirmation of malicious intent. The combination of a recent registration date, lack of SSL, low trust score, and multiple vendor detections points to an active threat actor using a generic gambling kit to target cryptocurrency users.

Defenders should immediately deny any outbound connections to 172.67.213.121 and add rollcoin.bet to DNS‑based blocklists, proxy filters, and endpoint security deny lists. Monitoring for newly registered domains that resolve to Cloudflare IP ranges and share the same nameserver pattern can help surface similar campaigns early. Because the site is already offline, investigators may request historical HTTP captures from the hosting provider or archive services to obtain additional artifacts.