lebandit[.]bet

On July 23, 2026, the domain lebandit.bet was observed to be taken offline after being identified as part of a crypto‑focused phishing campaign. The site presented the page title “Lebandit: Elon Musk’s Official Crypto Casino Powered by Blockchain,” which directly references a high‑profile individual and suggests a fraudulent casino service. Registration data shows the domain was created on 22 December 2025 through the registrar Spaceship, Inc., and is hosted on Cloudflare nameservers derek.ns.cloudflare.com and meera.ns.cloudflare.com. The SSL certificate presented is identified as “WE1,” indicating a low‑trust certificate.

Reputation checks reveal a Gridinsoft trust score of 0 out of 100, confirming a lack of legitimacy. VirusTotal scans recorded 15 detections out of 93 security vendors, reinforcing the malicious classification. The campaign utilizes the publicly known “Gambler Scam” phishing kit, and the domain has been added to at least one security blocklist and flagged by PhishDestroy. The current status is offline, but the presence of the domain on blocklists and the detection count suggest that similar infrastructure may be reused in future operations.

Defenders should continue to block the domain at perimeter defenses, monitor for any re‑registration or related subdomains, and apply URL filtering rules that reference the observed page title and the “Gambler Scam” kit signature. Because the domain leveraged a reputable registrar and Cloudflare DNS, additional scrutiny of Cloudflare‑hosted assets is advisable. Ongoing intelligence sharing with industry blocklist feeds will help surface related indicators promptly.