daddycsg38[.]bet

Analysis of daddycsg38.bet indicates that the domain was actively serving a crypto‑gambling front‑end that impersonates the Camelot brand. The site presented the title “Daddy Casino — Играй только в лучшие игры! Рекордные выигрыши вместе с нами!”, which aligns with the Gambler Scam phishing kit observed in other cryptocurrency gambling campaigns. The domain resolves to 172.67.175.210, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. Both authoritative nameservers listed for the zone are eugene.ns.cloudflare.com and faye.ns.cloudflare.com, confirming that the domain was registered through Cloudflare, Inc. No TLS certificate was observed, meaning the site was reachable only over HTTP.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans reported three detections out of ninety‑five antivirus engines, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and the current status is listed as offline. While the underlying infrastructure—Cloudflare‑provided DNS and IP address—remains reusable by the threat actors, the absence of a valid SSL certificate suggests a low‑cost deployment.

The exact page content beyond the title has not been captured, so the specific methods used to lure victims or harvest credentials remain unknown. Defenders should add 172.67.175.210 to network‑level blocklists, enforce DNS filtering for daddycsg38.bet, and monitor for any re‑registration of the same name or similar variations. Continuous observation of Cloudflare‑hosted IP ranges for new domains that reference Camelot or employ the Gambler Scam kit is recommended. Because the domain is already offline, immediate remediation focuses on preventing re‑use and alerting users to the brand‑impersonation risk.