roybet[.]top

The domain roybet.top was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the IP address 172.67.194.110, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The site presented the page title "ROYBET | Open the world of luck and rewards!" and was classified as a brand impersonation campaign targeting the foundation brand. The SSL certificate in use is identified as WE1, and the domain received a Gridinsoft trust score of 1 out of 100, indicating an extremely low reputation.

PhishDestroy has blocked the domain, and it appears on a single security blocklist. VirusTotal scanning recorded a single positive detection out of 93 security vendors, confirming that at least one vendor flagged the domain as malicious. The limited detection footprint and the low trust score suggest that the domain was likely used for a short‑lived phishing or fraud operation before being seized or taken down.

Uncertainties remain regarding the specific payload or credential‑stealing mechanisms employed, as no further page content or HTTP response details have been disclosed. Defenders should continue to monitor the associated IP range for any resurgence of malicious activity, enforce blocklists that include roybet.top, and ensure that any inbound traffic from Cloudflare‑hosted addresses is subject to additional scrutiny. Organizations using the foundation brand should alert users to the existence of this impersonation attempt and reinforce authentication controls to mitigate potential credential compromise.