likebet[.]top

On July 25, 2026, threat analysts examined the domain likebet.top, which is configured to impersonate the Foundation brand. The site was registered on January 06, 2025 through NameSilo, LLC and resolves to the IP address 104.21.84.18, a server hosted by Cloudflare, Inc. (AS13335) located in the United States. The domain uses the Cloudflare nameservers kay.ns.cloudflare.com and yew.ns.cloudflare.com, but no SSL certificate was observed, indicating unencrypted HTTP service at the time of capture. The page title returned by the HTTP response reads “LIKEBET | Play at the best online casino based on Blockchain,” suggesting the operators advertised a crypto‑based gambling service, consistent with the “Crypto Scam” classification attributed to the campaign. Infrastructure analysis linked the activity to the publicly available “Gambler Scam” phishing kit, further supporting the gambling motive.

Reputation metrics show a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. It has been blocked by the PhishDestroy filtering service, and VirusTotal recorded a single detection out of 93 security vendors, confirming that at least one independent scanner flagged the domain as malicious. The domain’s current status is offline, limiting immediate interaction, but the historical evidence suggests a deliberate attempt to lure users seeking blockchain casino services into a credential‑harvesting or cryptocurrency theft workflow.

Defenders should continue to monitor DNS activity for the IP 104.21.84.18 and the associated Cloudflare nameservers, enforce blocklisting of likebet.top at perimeter and endpoint controls, and consider adding the domain to threat‑intelligence feeds that track crypto‑related scams. Network telemetry should be examined for any residual connections, and any user accounts that may have interacted with the site prior to takedown should be scrutinized for signs of credential compromise or unauthorized crypto transactions.