cristbets[.]com

On 22 July 2026, cristbets.com was observed as an offline site that had previously hosted a brand‑impersonation campaign targeting the Blast brand. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and was created on 15 July 2025. DNS resolution points to a single IPv4 address, 57.129.97.29, which belongs to AS16276 (OVH SAS) and is geolocated in Germany. No TLS certificate is present, indicating that the site was served over plain HTTP.

The page title returned by the server reads “CRISTBETS | Enter the world of sport and stakes!”, a phrasing consistent with the “Gambler Scam” phishing kit identified in the intelligence. The infrastructure has been listed on one security blocklist and was actively blocked by the PhishDestroy sinkhole. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100. VirusTotal analysis shows that two of ninety‑five scanners flagged the domain, confirming malicious behavior.

The site’s status is currently offline, but the underlying domain and hosting assets remain under the control of the original operators. Defenders should continue to monitor the domain for re‑activation, block DNS resolution to 57.129.97.29 at the network perimeter, and add cristbets.com to internal URL filtering and email security policies. Because the page content has not been captured, the exact look‑and‑feel of the impersonation cannot be confirmed, and further investigation is required to determine whether additional sub‑domains or related IPs are being used for the same campaign.