mohbet[.]com

mohbet.com was registered on September 10, 2025 through Web Commerce Communications Limited and resolves to the Cloudflare address 104.21.42.105, an IP owned by AS13335 Cloudflare, Inc. in the United States. The site presented the page title “Mohbet: Most Popular Online Crypto Casino Based on Blockchain”, indicating a claim to operate a cryptocurrency‑based gambling service. Analysis of the hosting metadata shows the domain is served behind Cloudflare’s edge network and does not present an SSL certificate, which is atypical for a site handling financial transactions and suggests a lack of legitimate security controls. The domain was flagged by 12 of 95 VirusTotal scanners, was listed on a single security blocklist, and is actively blocked by PhishDestroy.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The known phishing kit associated with the domain is identified as the “Gambler Scam” kit, consistent with the crypto casino narrative. The nameservers hazel.ns.cloudflare.com and matias.ns.cloudflare.com are standard Cloudflare resolvers, offering no additional attribution. The site has been taken offline as of the reporting date, but historical evidence indicates a crypto‑scam phishing campaign targeting users of blockchain gambling platforms.

Uncertainty remains regarding the current command‑and‑control infrastructure and whether additional payloads were delivered, as no malware samples or URL snapshots are available. Defenders should continue to block the domain at network perimeter, monitor for any resurgence of the IP address or associated Cloudflare nameservers, and update detection signatures to include the “Gambler Scam” kit indicators. Threat‑intel feeds should be refreshed to capture any future registrations that reuse the same registrar or hosting patterns.