Cybercrime - Websites that look like casinos may be hiding illegal gambling, scams, and ...

New research from Infoblox Threat Intel reveals that casino websites with similar appearances may hide very different risks. Behind these pages, there may be illegal gambling and money laundering operations, scams targeting gamblers (known as scambling), or activities involving malware.

The warning for security teams is not to underestimate domains associated with Chinese casino websites or dismiss them as irrelevant in threat analyses. In this sense, simply observing the page in a browser may not be enough to distinguish a functioning casino from a fraudulent website or a command and control (C2) endpoint used in communication between malware and attackers' infrastructure.

The largest group analyzed in the research comprises over 1,7 million Chinese casino domains used for illegal gambling and money laundering. Infoblox Threat Intel monitors 16 domain clusters, of which the two largest, FUNNULL and Vigorish Viper , account for approximately 81% of the total monitored. Many of these sites function as actual casinos, with customer service and the ability to withdraw funds, which helps retain players and their deposits on these platforms.

A second group of websites, known as scambling sites, present themselves as online betting platforms but are designed to defraud users. They may manipulate games or resort to delays, fees, and other tactics to prevent withdrawals. According to the research, these sites primarily target English-speaking audiences, although their operators have also created pages aimed at people in Europe, South America, and Asia.

Taken together, these findings challenge a common assumption: that a casino domain represents merely a matter of low-value browsing or access policy. The research shows that defense teams need to assess what lies behind the page before closing an alert, because visible content alone does not reliably distinguish between gambling sites, fraud, and malware.

Zach Edwards, threat researcher at Infoblox, states: “The visual similarity is precisely the point. A security professional might identify a casino domain and reasonably treat it as a low-priority threat, while infrastructure with the same appearance could be hiding a scam or a malware command and control endpoint. This ambiguity is exactly why casino domains deserve closer scrutiny.”

The full research presents practical measures that security teams can take to combat these threats:

Regarding Infoblox Threat Intel

Infoblox Threat Intel is a leader in producing original threat intelligence on DNS, standing out in a market full of aggregators. What sets us apart? Two factors: deep DNS knowledge and unparalleled visibility.

DNS is recognized as complex to interpret and investigate, but our experience and privileged access to the inner workings of the internet allow us to track threat actors that others cannot identify. We act proactively, not just defensively, using our intelligence to disrupt cybercrime at its source.

We also believe in sharing knowledge to support the entire security community. That's why we publish detailed research and make indicators available on GitHub.

Furthermore, our intelligence is integrated with Infoblox DNS Detection and Responsive solutions, allowing customers to automatically reap their benefits with extremely low false positive rates.