beta-play[.]cc

beta-play.cc was registered on March 5 2026 through Gname.com Pte. Ltd. and resolves to 104.21.77.15, an address owned by Cloudflare (AS13335) located in the United States. The site presents a valid TLS certificate issued by Let’s Encrypt (E7) and returns HTTP 200 for the landing page. Nameservers listed are adaline.ns.cloudflare.com and owen.ns.cloudflare.com, confirming the continued use of Cloudflare’s DNS and CDN services.

The landing page bears the title “Beta-play: Most Popular Online Crypto Casino Based on Blockchain” and uses the Gambler Scam phishing kit. The page deliberately impersonates the Base brand, a classic brand‑impersonation tactic, and embeds third‑party tracking scripts such as Twitter Ads, Facebook Pixel, and Cloudflare Browser Insights. These scripts enable the operators to collect visitor analytics and potentially link harvested credentials to advertising networks.

Threat intel shows the domain appears on one security blocklist and has been flagged by 11 of 95 VirusTotal scanners, indicating moderate detection consensus. The Gridinsoft trust score of 0 / 100 reflects a highly malicious assessment, and the domain is already blocked by PhishDestroy. The combination of a fresh registration, Cloudflare front‑end, and a low trust score aligns with typical deployment patterns of fast‑moving impersonation campaigns.

Defenders should add beta-play.cc to block lists at the DNS and proxy layers, enforce TLS inspection to capture any credential‑submission traffic, and monitor for outbound requests to the embedded third‑party trackers. Email security gateways should treat any Base‑related communications originating from this domain as malicious, and incident response teams should consider sinkholing the IP address 104.21.77.15 to disrupt further victim exposure. Continuous monitoring of Cloudflare‑hosted malicious domains is recommended, as the infrastructure can be rapidly re‑hosted on new sub‑domains.