zolobetbritain[.]com

Analysis of zolobetbritain.com indicates a confirmed phishing domain targeting PayPal users, currently offline as of July 23, 2026. The domain was registered on November 5, 2025, through MainReg Inc. and is hosted behind Cloudflare infrastructure, resolving to the IP address 188.114.96.3 (AS13335, United States). Nameservers point to boyd.ns.cloudflare.com and gigi.ns.cloudflare.com, consistent with Cloudflare’s network. The domain’s SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare’s proxy services. Security vendor detections on VirusTotal report 15 flags out of 93 engines, confirming malicious classification by multiple providers. The domain appears on one security blocklist and is flagged by PhishDestroy, a specialized anti-phishing service.

AlienVault OTX records the domain in a single threat intelligence pulse, suggesting limited but confirmed exposure in threat-sharing communities. Gridinsoft assigns a trust score of 1 out of 100, further supporting the domain’s malicious classification. The page title, 'Zolobet ™ - The Official App WebSite 2026 [UPDATED],' does not directly reference PayPal, though the provided intelligence explicitly categorizes the domain as a PayPal impersonation scam. The scam type is classified as an e-commerce scam, a common tactic for phishing domains targeting payment platforms. MX records indicate a mail server at mail.zolobetbritain.com, which may have been used for phishing email distribution, though no direct evidence of email campaigns is available in the current data.

At the time of analysis, the domain returns an HTTP 503 status, indicating it is intentionally taken offline or experiencing technical disruption. This may reflect takedown efforts or evasion tactics by the threat actor. Defenders should treat this domain as high-risk and block it at the DNS and network levels. Security teams are advised to review logs for connections to 188.