Casino Websites Mask Money Laundering, Crypto Scams, and Malware C2

Threat researchers identified three criminal ecosystems hiding behind visually similar casino and adult websites: Chinese-language illegal gambling and money-laundering operations, fraudulent “scambling” platforms, and decoy sites hosting PeckBirdy malware command-and-control (C2) infrastructure. The Chinese-language gambling ecosystem spans more than 1.7 million domains and includes the FUNNULL CDN, Vigorish Viper, and Sable Squirrel networks; Sable Squirrel alone reportedly controls roughly 10,000 drop-caught expired domains, has spent more than $7 million acquiring them, and has been linked to 405 C2 domains and more than 31,000 malware samples communicating with its infrastructure. China-aligned actors have used PeckBirdy since 2023, embedding JavaScript and WebSocket C2 services in low-quality casino and adult sites, including cache-cdn[.]org, cache-mcp[.]com, mcp-source[.]online, and githubassets[.]net.

Separate scam-gambling networks use polished gaming and wagering sites promoted through Discord and social media, often advertising fraudulent $2,500 celebrity-linked credits. Victims can place simulated bets and see fabricated winnings, but withdrawals trigger demands for cryptocurrency “verification deposits” and further payments that never result in a payout. Researchers linked at least 1,270 recently registered domains to one centrally managed operation through shared code, tracking, support infrastructure, and chatbot credentials; affiliates have also expanded this scalable scam model. Organizations should treat casino or adult-domain DNS activity as a potential security signal rather than solely a policy issue, especially where endpoints resolve multiple distinct PeckBirdy-related domains.