pixy[.]bet

Analysis indicates that pixy.bet is an active high-risk domain used for a crypto-gambling phishing operation. The site was registered on 2026-02-21 through Domain Science Kutatási Szolgáltató Korlátolt Felelősségű Társaság and immediately pointed to the Cloudflare edge address 172.67.139.161 (AS13335). DNS resolution is provided by ns1.dns-redirect.com and ns2.dns-redirect.com. A TLS certificate identified as WE1 secures the site, and HTTP requests receive a 301 redirect response. The page title returned by the server is "PIXY | Open the world of luck and rewards!", consistent with a gambling-themed lure. Threat intelligence sources have flagged the domain: eight of ninety-three VirusTotal scanners reported malicious behavior, it appears on one public blocklist, PhishDestroy has added it to its blocklist, and AlienVault OTX includes it in a single pulse. The domain is also listed in the generic_phishing category with a high risk rating.

Evidence confirms the infrastructure and the presence of the domain in multiple threat feeds, but the actual content and credential-capture mechanisms have not been publicly disclosed. Defenders should block network connections to the IP address 172.67.139.161 and to the domain itself, enforce DNS filtering for the listed nameservers, and monitor for any traffic that matches the observed TLS fingerprint. Continuous re-evaluation is advised as further artifacts may emerge.