304bet[.]net

Analysis shows that 304bet.net is actively leveraged in a generic phishing campaign aimed at gambling victims. The site’s page title advertises “304bet Casino Games & Sports Betting | Play and Win Online,” suggesting a counterfeit gambling front. The domain was registered on May 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to Cloudflare IP 104.21.33.246, a server located in Canada. An SSL certificate issued by Let’s Encrypt (E8) is present, but the web server returns HTTP status 521, indicating Cloudflare‑controlled service unavailability, a pattern often observed with malicious hosts that toggle availability to evade detection. Security‑grade metrics are poor: Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 8 of 92 scanners flag the domain. The infrastructure aligns with the known Gambler Scam phishing kit, and the domain is listed on at least one security blocklist and has been blocked by PhishDestroy. AlienVault OTX references the domain in a single threat‑intel pulse, confirming its inclusion in broader threat‑sharing feeds. Defenders should treat 304bet.net as high‑risk, enforce DNS or firewall blocks, monitor for outbound connections to its IP, and consider adding the domain to internal allow‑list exclusions for security tools. Ongoing observation is advised to capture any changes in hosting or content, as current evidence is limited to registration data, infrastructure details, and third‑party detections.