reobeto[.]com

Analysis of reobeto.com indicates that the domain is being used for a crypto‑gambling impersonation campaign targeting the brand Blast. The domain was registered on July 12, 2025 through MAT BAO CORPORATION and is hosted on an OVH SAS network (ASN 16276) in Germany, resolving to IP address 57.129.97.29. The SSL certificate presented for the site lists XUI.one as both the subject and issuer, a pattern often observed in malicious infrastructure. Nameservers felicity.ns.cloudflare.com and maria.ns.cloudflare.com point to Cloudflare’s DNS service, a common choice for threat actors seeking anonymity and rapid deployment.

The page title returned during a brief probe reads "REOBETO | Enter the world of sport and stakes!", matching the declared scam type of Crypto Gambling and the phishing kit identified as a Gambler Scam. The site has been flagged by three of ninety‑five VirusTotal scanners, and it appears on one external security blocklist. PhishDestroy has already taken the domain offline, and the Gridinsoft trust score is recorded as 0 out of 100, confirming a lack of benign reputation.

Defenders should continue to block connections to 57.129.97.29 and monitor the associated Cloudflare nameservers for any re‑activation. Although the domain is currently offline, the infrastructure—particularly the OVH hosting and the XUI.one certificate—may be reused for future impersonation attempts. Organizations that brand themselves as Blast should update URL filtering rules to include reobeto.com and consider adding the domain to internal blocklists. Ongoing threat‑intel feeds should be queried for any resurgence of the domain or related indicators, and security teams should remain vigilant for similar crypto‑gambling kits that leverage the same registration and hosting patterns.