cratosroyabet1885[.]com

Analysis of cratosroyabet1885.com indicates active malicious infrastructure targeting users with a crypto gambling lure. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is presently hosted on Cloudflare's network (AS13335) with the IP address 104.21.23.100 located in the United States. DNS resolution uses the Cloudflare nameservers grant.ns.cloudflare.com and monika.ns.cloudflare.com, and the site serves content over HTTP/3. A TLS certificate issued by Google Trust Services (WE1) is present, confirming that the connection is encrypted but does not attest to the legitimacy of the underlying service.

An HTTP 301 redirect is observed, and the page title returned by the server is "CRATOSROYALBET," matching the reported scam type of crypto gambling. The domain appears on a single security blocklist and has been flagged by PhishDestroy, reinforcing its classification as a high‑risk phishing vector. VirusTotal scans show three out of ninety‑three AV engines flagging the domain, providing additional corroboration of malicious intent.

While the exact landing page content has not been captured, the combination of a recent registration, Cloudflare front‑end, encrypted traffic, and the presence on threat‑intel feeds suggests a purpose‑built phishing campaign. Defenders should block the domain at network perimeter devices, update URL filtering lists, and monitor for related indicators such as the Cloudflare IP address and the specific TLS certificate fingerprint. Continuous re‑evaluation is advised, as the threat actor may modify hosting or page content while retaining the same registration details.