beta-dirol[.]app

Analysis of beta-dirol.app indicates that the domain is actively serving a gambling‑related phishing campaign as of the report date, 12 July 2026. The site returns HTTP 200 responses and presents the page title “Dirol”. The domain was registered on 2 March 2026 through NiceNIC International Group Co., Limited and remains unresolved to a single IPv4 address (104.21.9.241). The host resolves to a network identified as AS13335, located in the United States, and is protected by a CDN that supplies HTTP/3 and browser‑insight capabilities.

The authoritative name servers listed are adam.ns.cloudflare.com and danica.ns.cloudflare.com, confirming the use of a third‑party edge service. TLS is provided by a free certificate authority, delivering a valid HTTPS endpoint with a Let's Encrypt‑issued certificate (E7). The web stack reports PHP execution, indicating dynamic content generation. No additional infrastructure such as back‑end databases or external services is disclosed in the available intelligence.

Threat intelligence shows the domain appears on four independent blocklists, including SEAL, MetaMask, PhishDestroy, and BLP‑Malware. VirusTotal scans have resulted in six positive detections out of ninety‑five scanners, and the Gridinsoft trust score is 0 / 100, reinforcing the high‑risk classification. The combination of a gambling scam label, a generic page title, and the low trust metrics suggests purposeful credential harvesting or payment redirection targeting users seeking gambling services.

Defenders should block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP address, and consider adding the URL to internal phishing‑filtering rules. Continuous re‑evaluation is advised, as the infrastructure could be re‑hosted behind different edge nodes. Logging of TLS handshake attempts and HTTP request patterns will aid in correlating future activity with this indicator of compromise.