Infoblox identifies 1.7 million illegal Chinese gambling domains

Cybersecurity firm Infoblox has identified more than 1.7 million domains linked to illegal Chinese-language casino activity. The research reveals that these domains are organized into several distinct categories: illegal gambling platforms, fraudulent “scambling” sites designed to defraud users, and decoy pages used to hide malware command-and-control infrastructure, specifically the PeckBirdy framework used by China-aligned threat groups.

The activity is highly concentrated, with two major networks, FUNNULL and Vigorish Viper, accounting for approximately 81 percent of the tracked domains. Operators maintain the network by constantly rotating domain names; when one address is blocked, they redirect users to another from a large pool, making mitigation difficult.

Some fraudulent sites misuse established brands, such as the Venetian Macao, to gain user trust. Infoblox noted that while these sites appear to be legitimate casinos with customer support and withdrawal functions, they are often used for money laundering, consumer fraud, or as endpoints for cyberespionage tools.