1xbetus-play[.]com

The domain 1xbetus-play.com was registered on 14 June 2026 via Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to 209.74.82.247, an address announced by AS22612 (Namecheap, Inc.) and traced to Singapore. The site presents a Let’s Encrypt TLS certificate labeled “YR2”, which supplies encryption but no commercial warranty. Authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com, consistent with low‑cost DNS hosting.

Web delivery is handled by an Nginx server that issues an HTTP 302 redirect to a page whose title reads “1xbet — Premium Online Casino & Sports Betting | 1xBet US”. The content aligns with a known “Gambler Scam” phishing kit, and the Gridinsoft trust score for the domain is recorded as 0 out of 100, indicating a complete lack of credibility. VirusTotal analysis shows that 3 out of 95 scanned security vendors flag the domain as malicious, reflecting a modest but non‑trivial detection rate.

Threat intelligence classifies this infrastructure as a high‑risk brand‑impersonation campaign targeting users of crypto‑focused casino and gambling services. The domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL, and its risk level is marked as high while remaining actively reachable. The combination of a recently created domain, low trust score, and use of a generic gambling phishing kit suggests deliberate attempts to harvest credentials or financial information from unsuspecting visitors.

Defenders should add 1xbetus-play.com to network and endpoint blocklists, enforce TLS inspection to capture the 302 redirect, and monitor for similar Let’s Encrypt‑issued domains that resolve to the same IP range. Additional steps include sinkholing the IP address, reviewing DNS queries for the dnspod nameservers, and notifying users of the fraudulent 1xBet branding to reduce successful credential harvest.