New research from Infoblox Threat Intel has tracked more than 1.7 million casino-style domains that on the surface look like ordinary online gambling sites but in practice mask very different risks, ranging from illegal gambling and money laundering to consumer fraud and malware command-and-control infrastructure. The research is particularly relevant to Singapore and the wider region, where consumer scams remain a persistent concern and “scambling” sites target English-speaking audiences, including users in Asia.

The largest cluster in the research covers Chinese-language casinos built for illegal gambling and money laundering. Infoblox tracks 16 distinct clusters within this population, with the two largest, FUNNULL and Vigorish Viper, accounting for roughly 81 percent of the domains tracked. These sites often function as genuine casinos, complete with working customer support and withdrawals, which helps them retain players and deposits over time.

When a casino site is actually a scam

A second group of sites, which Infoblox terms “scambling”, presents itself as online gambling but is built specifically to defraud users, either by rigging games or by blocking withdrawals through delays, fees and other tactics. A third and smallest group embeds PeckBirdy command-and-control domains, a framework used by China-aligned advanced persistent threat groups since 2023, within low-quality Chinese-language casino sites. Just over 3 percent of enterprise customers in Infoblox’s telemetry resolved at least one related domain.

“The visual similarity is the point. A defender can see a casino domain and reasonably treat it as low priority, while the same-looking infrastructure may hide a scam or a malware command-and-control endpoint. That ambiguity is exactly why casino domains deserve closer review,” said Zach Edwards, Staff Threat Researcher at Infoblox.

The regional scale of the problem

The findings land against a wider backdrop of losses from transnational online scam operations across East Asia, Southeast Asia, Australia and New Zealand, which the United Nations Office on Drugs and Crime estimated at between US$88.3 billion and US$114.1 billion for 2025 alone. Infoblox’s research suggests defenders need to look past a domain’s surface appearance before deciding whether it warrants closer scrutiny, since gambling, fraud and malware infrastructure can all wear the same disguise.