Chinese-language casino-lookalike domains can hide illegal betting, scams, and malware C2 infrastructure

A new Infoblox Threat Intel report says that pages that look like casino sites can sit on top of very different operations: illegal betting and money laundering, scambling (fraudulent betting sites), or even command-and-control (C2) endpoints for malware. For PSPs, acquirers, and banks, the useful part is obvious: a casino-like domain is not automatically a casino, and a browser screenshot is not a reliable risk assessment.

1. The largest cluster in the research contains more than 1.7 million Chinese-language casino domains used for illegal betting and money laundering. Infoblox Threat Intel tracks 16 domain clusters in total, and the two biggest, FUNNULL and Vigorish Viper, account for about 81% of the monitored set.
2. Many of these sites are real casinos in the operational sense: they offer customer support and allow withdrawals. That matters because the presence of payouts and service desk features can keep players depositing funds on the platform, which in turn makes the infrastructure look more legitimate than it is from the outside.
3. A second group, described as scambling, presents itself as online betting but is built to scam users. The report says these sites can manipulate games or use delays, fees, and other tactics to block withdrawals. Their main target is English-speaking users, but the operators have also built pages aimed at people in Europe, South America, and Asia.
4. The smallest group is more operationally awkward: it embeds PeckBirdy C2 domains inside low-quality Chinese-language casino sites. PeckBirdy is a framework used by China-aligned advanced persistent threat (APT) groups since 2023. According to Infoblox telemetry, a little more than 3% of monitored enterprise customers resolved at least one domain linked to this infrastructure, and one of the domains had no VirusTotal detection as of 31 August 2026.
5. The practical takeaway is that defenders should look behind the page before closing a ticket. A casino-looking domain can be low-value browsing noise, a fraud site, or malware infrastructure, and the visible content alone does not reliably tell you which one you are dealing with.