muskempire[.]bet

The domain muskempire.bet was registered on 21 February 2026 and is currently offline. The site presented the page title "Muskempire: Most Popular Online Crypto Casino Based on Blockchain," indicating a crypto‑casino impersonation. Infrastructure analysis shows the domain resolves to IP 104.21.77.61, which belongs to Cloudflare, Inc. (AS13335) located in the United States. The SSL certificate labeled WE1 was observed, but no further certificate details are available. The site employed the publicly known Gambler Scam phishing kit, a package frequently used to harvest cryptocurrency credentials.

VirusTotal scans recorded 12 positive detections out of 93 security vendors, confirming malicious classification. The domain is listed on one security blocklist and is actively blocked by PhishDestroy. The threat type is identified as a crypto scam, specifically targeting users of online gambling platforms. The presence of the Gambler Scam kit suggests the attacker is leveraging pre‑built scripts to mimic legitimate casino login flows, increasing the likelihood of credential theft. Although the SSL certificate appears valid, the use of Cloudflare’s reverse‑proxy service can obscure the true origin of the malicious server.

The 12/93 VirusTotal detections include vendors that flag the domain for phishing, malicious URL, and cryptocurrency fraud, reinforcing the elevated risk assessment. No additional evidence such as safe‑browsing verdicts, OTX mentions, or registrar information is present in the current intelligence, leaving the scale of victimization and any reuse of the infrastructure uncertain. Defenders should continue to block the domain at perimeter and DNS filters, monitor Cloudflare‑assigned IP ranges for related activity, and update internal phishing detection rules to flag the Gambler Scam kit signatures. Incident response teams should also verify internal logs for connections to 104.21.77.61 and ensure credential‑reset procedures for compromised crypto accounts.