944bettvole[.]com

Analysis of the domain 944bettvole.com indicates it was a phishing site operating as a crypto gambling scam, now offline as of July 25, 2026. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolved to the IP address 104.21.83.246, hosted on Cloudflare's network (AS13335), a common obfuscation tactic used to conceal the true origin of malicious infrastructure. Nameservers brit.ns.cloudflare.com and carlos.ns.cloudflare.com further confirm Cloudflare's involvement in the domain's resolution. The page title, "Betvole I Spor Bahisleri, Casino, Canlı Casino, Tombala, Poker - En Güvenilir Online Bahis ve Casino Sitesi," suggests the site targeted Turkish-speaking users with fraudulent online gambling services, specifically crypto-based betting.

The scam type is classified as a "Gambler Scam," a phishing kit known for luring victims into depositing cryptocurrency under false pretenses. No SSL certificate was detected, increasing the likelihood of interception or tampering during user interactions. Detection data is limited but indicative of malicious activity. The domain appears on one security blocklist, and three of 93 security vendors on VirusTotal flagged it as malicious prior to takedown. The absence of broader detection does not imply safety, as phishing domains often evade initial scans before gaining traction.

PhishDestroy, a specialized anti-phishing service, had blocked the domain, reinforcing its classification as a threat. Defenders should treat this domain as part of a broader pattern of crypto gambling scams leveraging Cloudflare for anonymity. Monitoring for newly registered domains under the same registrar or resolving to similar Cloudflare IPs may help preempt future campaigns. Network-level blocking of the IP 104.21.83.