1806betnano[.]direct

Analysis as of July 24, 2026 indicates that the domain 1806betnano.direct was registered on February 27, 2026 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 104.21.89.5, which belongs to AS13335 Cloudflare, Inc., placing the hosting infrastructure in the United States. No TLS certificate is presented for the site, and the only observed HTTP response contains the page title "Just a moment...", suggesting a placeholder or redirection page rather than a fully rendered service. The site is classified as a crypto‑gambling phishing operation, aligning with the generic phishing threat type cited in the intelligence.

VirusTotal reports that two out of ninety‑three scanning engines flagged the domain, and the domain appears on a single security blocklist. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy has already blocked the domain. Nameservers are alice.ns.cloudflare.com and peter.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

The current operational status is offline, limiting immediate exposure but indicating that the infrastructure may be re‑activated. Defenders should continue to monitor the IP address and associated Cloudflare nameservers for future re‑hosting attempts, enforce blocklist entries in perimeter defenses, and consider adding the domain to internal URL filtering policies. Because the page content has not been captured beyond the title, further investigation is required to determine the exact lure used and any credential‑stealing mechanisms that may have been deployed while the site was active.