jojolbet1138[.]com

Analysis dated 25 July 2026 confirms that the domain jojolbet1138.com is being used for a crypto‑gambling phishing campaign. The domain was created on 27 February 2026 and registered through NiceNIC International Group Co., Limited. It is delegated to Cloudflare authoritative nameservers chris.ns.cloudflare.com and gail.ns.cloudflare.com, and resolves to IP address 104.21.39.211, which is owned by AS13335 Cloudflare, Inc. and located in the United States. No TLS certificate is presented, indicating the site operated over plain HTTP. The only page metadata recovered is the title "Un instant…"; no further page content has been captured because the site has been taken offline.

Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. VirusTotal reports that 7 of 93 scanning engines flagged the host as malicious, reinforcing the suspicion of illicit activity. The domain is currently listed as blocked by the PhishDestroy network. Uncertainties remain regarding the specific phishing vectors, such as whether credential‑stealing forms or malicious downloads were delivered, because the site is no longer reachable for deeper inspection. No evidence of additional infrastructure, such as command‑and‑control servers or payload hosting, has been observed.

Defenders should immediately block jojolbet1138.com and the underlying IP address at firewalls, proxy gateways, and DNS filtering solutions. Continuous monitoring of the Cloudflare IP range for new domains that resolve to the same address is advisable, as threat actors often reuse this hosting. Adding the indicator set to internal threat‑intel feeds and sharing it with upstream block‑list operators will help prevent re‑use. Periodic re‑query of VirusTotal and other reputation services is recommended to detect any future re‑activation of the domain.