pacifica[.]bet

pacifica.bet was observed as an active malicious endpoint until it was taken offline prior to the report date of 24 July 2026. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is delegated to Cloudflare nameservers ainsley.ns.cloudflare.com and piotr.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating that the site was served over plain HTTP at the time of capture. The only visible HTML element is a page title of “Just a moment…”, and the Gridinsoft trust score assigned to the host is 0 out of 100, reflecting a completely untrusted rating.

Dynamic analysis on VirusTotal shows that two of ninety‑three scanning engines flagged the domain, suggesting the presence of malicious characteristics, though the majority of engines did not raise an alert. The domain appears on four external blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, reinforcing its classification as a crypto‑gambling phishing operation. The specific scam type is listed as “Crypto Gambling”, indicating that the site likely attempted to lure victims into fraudulent gambling or investment schemes involving cryptocurrency. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms employed, as no sample content or network traffic has been released publicly.

Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of the host, and correlate any outbound connections to 188.114.96.3 with internal user activity. Because the domain is hosted on a shared Cloudflare infrastructure, threat‑intel teams should also watch for other subdomains that resolve to the same IP address. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in detection rates.