admiralbet[.]de

Analysis indicates that the domain admiralbet.de is active and is being leveraged for a high‑risk crypto gambling phishing operation. The site presents the page title "Online Sportwetten mit Top Wett-Quoten! | AdmiralBet Deutschland," suggesting an attempt to impersonate a legitimate sports betting service. Infrastructure observations show the domain resolves to IP 159.60.150.61, hosted in the United States and associated with AS35280 (F5 Networks SARL). The server employs Envoy as a reverse‑proxy, enforces HTTP Strict Transport Security, and includes Google Tag Manager scripts, all of which are consistent with a modern web stack. A 301 redirect is observed, and the TLS certificate is issued by DigiCert Global G2 (RSA SHA256, 2020 CA1). Reputation data reveals that 2 of 93 VirusTotal scanners flagged the domain, it appears on one security blocklist, and it is listed by PhishDestroy. The domain’s DNS configuration uses UltraDNS and Cloudflare name servers, while its MX records point to greentube.com mail hosts. Gridinsoft assigns a trust score of 0/100, and the scam type is identified as Crypto Gambling. Evidence confirms a high‑risk phishing profile, but the exact content of the landing page and the credential‑harvesting mechanisms remain unverified. Defenders should block admiralbet.de at perimeter and DNS layers, monitor for related C2 traffic, and consider sinkholing the associated IP. Continuous re‑evaluation is advised as additional indicators may emerge.