bet-online[.]pro

The domain bet-online.pro was registered on 26 December 2025 through Web Commerce Communications Limited and employs four Eternity Nameservers, including ns4.eternitynames.net, ns2.eternitynames.net, and ns3.eternitynames.net. DNS resolution directs traffic to the IP address 172.67.167.54, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. The web service presents an Nginx server front‑end and serves an HTTP 404 response whose page title reads "404 Not Found," indicating that the malicious landing page has been removed or is no longer reachable.

The site employed a Let’s Encrypt certificate (issuer Let's Encrypt / E7), a common choice for short‑lived phishing infrastructure. VirusTotal analysis recorded 14 detections out of 95 scanned scanners, confirming that multiple security products recognize the domain as malicious. Independent threat‑intel sources classify the campaign as a "Crypto Gambling" phishing operation, suggesting that victims were likely lured with fraudulent gambling offers tied to cryptocurrency.

The domain is presently listed on a single security blocklist and has been taken down by the PhishDestroy takedown service. Defenders should continue to block the IP 172.67.167.54 at the network perimeter, enforce DNS filtering for the bet-online.pro domain, and monitor any residual activity that may arise from related sub‑domains or newly provisioned IPs under the same Cloudflare ASN. Although the active web content is offline, the observed infrastructure—registrar, nameserver pattern, and certificate usage—provides actionable indicators for threat‑hunting workflows and may aid in attributing future campaigns that reuse similar components.