rollking[.]bet

Analysis of the domain rollking.bet indicates it is actively engaged in banking phishing operations as of July 12, 2026. The domain was registered on March 6, 2026, through CommuniGal Communication Ltd., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 185.53.179.200, which is hosted on AS206834 (Team Internet AG) and geolocated in Canada. This IP address has been linked to multiple phishing campaigns, suggesting a pattern of malicious infrastructure reuse. The domain employs nameservers ns15.abovedomains.com and ns16.abovedomains.com, a configuration commonly observed in phishing domains leveraging bulletproof hosting providers. Detection metrics further support the malicious classification, with 12 out of 95 security vendors flagging rollking.bet on VirusTotal. Additionally, the domain appears on one security blocklist, and its Gridinsoft trust score of 39 out of 100 reflects a high-risk assessment. The SSL certificate, identified as R13, is consistent with certificates used in phishing kits to lend superficial legitimacy to fraudulent sites. The page title, which matches the domain name (rollking.bet), is a tactic often employed to avoid immediate suspicion while impersonating financial institutions. The HTTP status code 200 confirms the site is operational and serving content, though the specific phishing kit or targeted brand remains unconfirmed. Defenders should prioritize blocking this domain at the DNS and network levels, particularly for organizations in the financial sector. Monitoring for related domains registered through the same registrar or resolving to the same IP address may uncover additional threats in this campaign. Given the domain's active status and detection history, continued vigilance is warranted.