d2w[.]bet

Analysis of d2w.bet indicates that the domain was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the address 172.67.208.94, which belongs to AS13335 operated by Cloudflare, Inc., a common hosting provider for malicious infrastructure. The site returns an HTTP 404 status with the page title “404 Not Found,” suggesting the payload page has been removed or is inaccessible. SSL/TLS inspection shows the certificate identified as “WE1,” a generic certificate often observed on compromised or short‑lived domains.

Threat intelligence categorises the domain under the “Crypto Gambling” scam type, aligning with a broader campaign that lures victims into fraudulent gambling services that request cryptocurrency payments. Four of ninety‑three security scanners on VirusTotal flagged the domain, confirming that at least a subset of AV engines detects malicious behavior. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy service, indicating that network‑level defenses are already enforcing mitigation. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange (OTX) references were observed in the supplied data.

Given the limited exposure, uncertainty remains regarding the exact phishing payload or any credential‑stealing pages that may have existed before the domain was taken offline. Defenders should continue to monitor DNS queries for 172.67.208.94 and related Cloudflare ranges, enforce blocklist updates that include d2w.bet, and ensure that any user‑agent that attempted to access the domain is examined for potential credential leakage. Organizations employing web‑filtering solutions should retain the current block and consider adding the IP address to a broader deny list for the duration of the investigation. Ongoing collection of endpoint telemetry is recommended to capture any residual activity that may have originated from this short‑lived infrastructure.