roobetsaap[.]com

The domain roobetsaap.com is currently active and was registered on March 11, 2026 through Dynadot LLC. HTTP requests return a 200 status and the site presents a page titled "RooBet - Casino with Bonus for Crypto-Players," indicating a crypto gambling operation. The infrastructure is hosted behind Cloudflare, using the nameservers clay.ns.cloudflare.com and sarah.ns.cloudflare.com, and resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, United States. SSL is provided by Google Trust Services / WE1. Email routing includes an MX record pointing to a subdomain (_dc-mx.7bbcd3e3fe8a.roobetsaap.com), a pattern often seen in malicious setups. The domain is listed on three security blocklists, appears in one AlienVault OTX pulse, and is blocked by PhishDestroy, MetaMask, and SEAL. Security scanning on VirusTotal shows one of 94 vendors flag the domain, and Gridinsoft assigns a trust score of 0/100, reinforcing its malicious nature. The site employs a known "Gambler Scam" kit and explicitly impersonates the Counter-Strike brand, classifying the activity as brand impersonation with a high risk rating. Defenders should block the domain at network and endpoint layers, add the associated IP and MX host to threat feeds, and monitor for any related indicators of compromise. Continuous re‑evaluation is advised, as further analysis of the page content and user interaction flow has not been performed.