rollbit[.]us[.]com

This domain, rollbit.us.com, is flagged as an active phishing threat targeting cryptocurrency gambling users. Registered on May 1, 2026, through Instra Corporation Pty Ltd., the domain resolves to 178.159.43.76, an IP address hosted in the Netherlands by Podaon SIA. Analysis indicates the site mimics the branding of a legitimate crypto casino, presenting itself under the title 'Rollbit Casino - Crypto Casino, 1000x Futures & Sports Betting.' The domain is currently operational, returning an HTTP 200 status, and employs a Let's Encrypt SSL certificate, which may lend a false sense of legitimacy to unsuspecting visitors. Infrastructure review reveals the domain is associated with the 'Gambler Scam' phishing kit, a known framework used to harvest credentials and cryptocurrency wallet details. Security vendors have detected malicious activity, with 2 out of 95 engines on VirusTotal flagging the domain, and it appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The nameservers are managed by CentralNic, a common provider for both legitimate and malicious domains, which does not inherently indicate compromise but aligns with patterns observed in phishing operations. The risk level is classified as high due to the domain's active status, its presence on multiple security blocklists, and its association with a known phishing kit. While the low detection rate on VirusTotal may suggest some evasion techniques, the domain's inclusion on specialized blocklists targeting financial fraud reinforces its malicious intent. Defenders should treat this domain as a confirmed threat and implement blocking measures at the DNS or network level. Monitoring for related domains registered under the same infrastructure or using similar naming conventions is recommended to preempt further campaigns.