royalbet-ile[.]cfd

Analysis indicates that royalbet-ile.cfd is currently active and classified as a generic phishing site. The domain was registered on 2026-04-16 and the website returns HTTP 200 responses, suggesting a live front‑end. The TLS certificate is issued by a widely trusted authority and is valid, which can help the site appear legitimate to users. The domain resolves to the IP address 104.21.15.31, which is hosted within a Canadian content‑delivery network, providing anonymity and rapid content delivery.

Infrastructure assessment shows a Gridinsoft trust score of 0 out of 100, indicating the highest level of distrust. VirusTotal records show that 2 of 95 scanned security vendors flagged the domain, demonstrating that at least some scanners detect malicious characteristics. The domain appears on one public phishing blocklist and is also referenced in a single AlienVault OTX threat pulse, reinforcing its association with phishing campaigns. Its registration was processed through a registrar identified as FewMoreTaps OÜ, a detail that offers limited attribution value.

The available intelligence confirms the domain’s malicious intent, but the exact phishing content, credential‑harvesting mechanisms, and any downstream payloads remain unknown because no payload samples or page snapshots were provided. Consequently, defenders cannot assess the full scope of the victim profile or the potential data exfiltration techniques employed.

Defenders should immediately block royalbet-ile.cfd at perimeter and DNS layers, and add the IP 104.21.15.31 to any network‑level deny lists. Continuous monitoring for DNS queries and HTTP requests to the domain is advised, as well as periodic re‑scanning with updated malware classifiers. Where possible, capture traffic to the site for deep packet inspection to identify credential‑stealing forms or redirects. Coordination with threat‑intel sharing communities can help enrich the profile as new indicators emerge.