dronxbet[.]com

Analysis of the domain dronxbet.com indicates it was actively involved in a cryptocurrency-based phishing campaign targeting users through a fraudulent online casino scheme. The domain was registered on September 16, 2025, via NameSilo, LLC, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolved to IP address 172.67.151.138, hosted under Cloudflare, Inc. (AS13335), a provider commonly used to obscure malicious infrastructure. Nameservers clarissa.ns.cloudflare.com and leo.ns.cloudflare.com further confirm Cloudflare as the DNS provider, which may have contributed to delayed detection. The domain lacked an SSL certificate, an atypical characteristic for a purported crypto casino, increasing the likelihood of interception or manipulation of user data. The page title, 'Dronxbet: Most Popular Online Crypto Casino Based on Blockchain,' suggests an attempt to lure victims with promises of blockchain-based gambling, a known tactic in crypto scam operations.

The Gambler Scam phishing kit, identified in the intelligence, is consistent with this classification, though specific kit artifacts or payloads have not been publicly confirmed. Detection metrics indicate moderate but growing awareness among security vendors. As of the report date, nine out of ninety-three security vendors on VirusTotal flagged dronxbet.com as malicious. The domain appeared on one security blocklist and was included in a single AlienVault OTX threat intelligence pulse, suggesting limited but targeted dissemination. Trust scores from Scamadviser and Gridinsoft both rated the domain at 1/100 and 0/100, respectively, reflecting high confidence in its fraudulent nature.

PhishDestroy also blocked the domain, reinforcing its classification as a phishing threat. The domain is currently offline, though historical resolution and detection data remain relevant for retrospective analysis.