go-roobet[.]com

This domain, go-roobet.com, is flagged as a generic phishing infrastructure designed to mimic the Roobet online gambling platform. Analysis indicates the site functions as a credential-harvesting portal, targeting users attempting to log in to their accounts. The phishing page employs a cloned interface to deceive victims into submitting usernames, passwords, and potentially two-factor authentication codes. No direct association with known cryptocurrency drainer kits has been observed, though the domain’s rapid takedown suggests active monitoring by security teams. Infrastructure analysis reveals the domain was registered on September 01, 2025, through Gname.com Pte. Ltd. and currently resolves to the IP address 104.21.48.38, hosted on Cloudflare’s network (AS13335). VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate, issued by Google Trust Services (WE1), aligns with common phishing tactics leveraging legitimate certificate authorities to appear trustworthy. At the time of assessment, the domain displays a Cloudflare interstitial page with the title 'Attention Required!', indicating it may have been suspended or is undergoing automated filtering. The domain has been taken offline, likely due to enforcement actions by the hosting provider or registrar. However, residual risk remains as threat actors may re-deploy the phishing infrastructure under a new domain or IP address. Users who interacted with the site should immediately rotate credentials, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations are advised to block the domain and associated IP (104.21.48.38) at the network level to prevent further exposure. Continuous monitoring for similar domains registered through the same registrar (Gname.com Pte. Ltd.) is recommended to mitigate follow-up campaigns.