payscrow[.]bet

The domain payscrow.bet has been identified as a brand impersonation threat specifically targeting users of crypto casino and gambling platforms. Analysis indicates this domain was designed to mimic legitimate blockchain-based gambling services, presenting itself as a popular online crypto casino. As of the latest assessment, the domain has been taken offline, though prior activity suggests malicious intent to deceive users into engaging with fraudulent gambling services or exposing sensitive financial information. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on December 13, 2025, and resolved to the IP address 188.114.96.3, which is associated with Cloudflare, Inc. (AS13335) in the United States. Detection metrics show that 16 of 95 security vendors on VirusTotal flagged this domain as malicious, while it also appears on at least one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), a common characteristic observed in both legitimate and malicious domains leveraging Cloudflare’s infrastructure. The page title, 'Payscrow: Most Popular Online Crypto Casino Based on Blockchain,' further confirms the intent to impersonate established crypto gambling brands. Given the elevated risk level and the domain’s current offline status, users are advised to exercise caution when encountering any references to payscrow.bet or similar domains. Organizations should update their security controls to block this domain and monitor for related infrastructure, such as the IP address 188.114.96.3, which may be reused in future campaigns. End-users are strongly recommended to verify the authenticity of crypto gambling platforms through official channels and avoid interacting with domains flagged by multiple security vendors. If financial transactions were conducted on this domain, affected parties should review their accounts for unauthorized activity and consider reporting the incident to relevant authorities.