betlucro[.]fun

The domain betlucro.fun was registered on 27 February 2026 through Hostinger Operations UAB and immediately pointed to Cloudflare’s network (ASN 13335). The authoritative nameservers garrett.ns.cloudflare.com and irena.ns.cloudflare.com resolve the domain to IP 172.67.183.30, a Cloudflare edge node located in the United States. No TLS certificate was observed; the site served only over plain HTTP, which is consistent with the reported “offline” status at the time of analysis. Public blocklist monitoring shows the domain appears on three reputable phishing blocklists – PhishDestroy, MetaMask, and SEAL – confirming that security vendors have classified it as malicious.

VirusTotal scans recorded detections from two of ninety‑three AV engines, reinforcing the suspicion that the site hosted a crypto‑gambling phishing campaign. The page title returned by the HTTP response is “BET LUCRO”, matching the listed scam type of “Crypto Gambling”. This combination of recent creation, Cloudflare hosting, absence of SSL, low‑volume AV detections, and multiple blocklist listings suggests a short‑lived infrastructure built to lure victims into a fake gambling platform, likely to harvest cryptocurrency credentials. Evidence gaps remain: the exact content of the landing page, any credential‑stealing forms, and the presence of additional payloads have not been captured because the site was taken offline before a full crawl could be performed.

Consequently, attribution of the operators is limited to the registrar information. Defenders should continue to block betlucro.fun at perimeter filters, update URL‑allow lists to include the observed IP range if applicable, and monitor for any resurgence of the domain or similar Cloudflare‑hosted nameservers. Ongoing threat‑intel feeds should be consulted for new detections, and any future resolution of the domain to an active host should be re‑examined for malicious payloads.