Infoblox flags scam gambling traffic targeting Australia and New Zealand

Infoblox has published research on “scambling” — casino-like sites that can sit in front of illegal gambling, fraud, money laundering, and malicious infrastructure. For PSPs and risk teams, the useful part is not the costume but the plumbing: the same-looking domain can be a payments funnel, a laundering layer, or a malware command path.

1. Infoblox says it tracks 16 clusters of this infrastructure. The largest segment is more than 1.7 million Chinese-language casino domains, and the two biggest clusters — FUNNULL and Vigorish Viper — account for about 81% of the tracked population.
2. Many of the larger sites operate like real casinos, with live support and actual payouts. That helps them pull in deposits while hiding the illegal activity running alongside the gambling front.
3. Infoblox separates that from “scambling” proper: sites built to imitate legitimate gambling but designed to scam users. The mechanics are familiar enough — rigged games, blocked withdrawals, delays, and hidden fees — and the audience is mainly English-speaking, with activity also seen in Europe, South America, and Asia.
4. Telemetry from Infoblox shows regular connection attempts from Australia and New Zealand to both scam-gambling domains and illegal gambling sites. Some of the traffic comes through spam links and ads; some is routed through malicious advertising networks, or Traffic Distribution Systems, that use hacked websites, compromised routers, parked domains, and typosquatting domains.
5. Researchers also identified a group of low-quality Chinese-language casino sites that embedded C2 domains for the PeckBirdy malware. Infoblox says Chinese government-aligned APT groups have used PeckBirdy since 2023. More than 3% of corporate customers in Infoblox’s telemetry were associated with those domains.

According to Infoblox staff threat researcher Zak Edwards, in an average month in 2026 clients in Australia and New Zealand try to connect to about 10 unique scam-gambling domains and more than 100 illegal gambling sites. The company says PeckBirdy activity in the region is still minimal, but it is watching the campaign through the year.