{"id":14140,"date":"2026-09-15T08:00:19","date_gmt":"2026-09-15T15:00:19","guid":{"rendered":"https:\/\/www.infoblox.com\/blog\/?p=14140"},"modified":"2026-09-15T08:23:49","modified_gmt":"2026-09-15T15:23:49","slug":"how-money-laundering-scams-and-espionage-hide-in-a-web-full-of-casino-garbage","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/how-money-laundering-scams-and-espionage-hide-in-a-web-full-of-casino-garbage\/","title":{"rendered":"How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage"},"content":{"rendered":"

Why Should Anyone Care About Casino Websites?<\/h3>\n

Many security teams ignore online gambling and casino domains, especially Chinese-language websites. Over the last decade there\u2019s been massive growth in both gambling websites catering to Chinese audiences and similar casino sites targeting people all over the world. There\u2019s also been growth in legal gambling and casino websites, but the scale of these compared to the malicious casinos is marginal.<\/p>\n

<\/p>\n

This report focuses on the crime disguised by the proliferation of betting sites that litter the internet. There are three major purposes hiding behind most illicit online casino sites: facilitating illegal gambling across China and Asia, and laundering money; stealing money from customers or preventing them from cashing out (\u201cscambling\u201d); and operating command-and-control (C2) infrastructure under the cover of a casino website. That last category is used by little-known China-aligned advanced persistent threat (APT) actors operating since 2023 using a C2 framework known as PeckBirdy to attack corporate and government targets across Asia.<\/p>\n

PeckBirdy is not the only actor using this approach. Sable Squirrel, documented in recent Infoblox research<\/strong><\/a>, uses the same technique at larger scale: controlling more than 10,000 domains and spending an estimated $7 million on expired domains to build a streaming and gambling empire that also functions as malware C2 infrastructure.<\/p>\n

Our new casino research shows an expansion of the industries being targeted with these ongoing PeckBirdy APT campaigns, which are now also using low-quality Chinese-language adult websites as part of the ruse. We also documented a C2 domain being used by the PeckBirdy framework that had zero detections on VirusTotal at the time of this publication.<\/p>\n

The hardest part of sorting these sites into the three categories is that they look nearly identical in a browser. From the three websites shown in Figure 1, can you guess which one is used in a PeckBirdy campaign?<\/p>\n

<\/p>\n

Figure 1. Screenshots of three casino sites from left to right, vip311[.]cc, zzyud[.]com, zenplay77-x[.]space; vip311[.]cc is associated with PeckBirdy<\/p>\n

The answer is vip311[.]cc\u2014the site on the left, a PeckBirdy C2 domain used by China-aligned APT groups.<\/p>\n

Sorting the Lookalikes<\/h3>\n

We track three distinct types of these malicious casino websites. They look similar in a browser, but behave nothing alike underneath, as Table 1 shows.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
<\/th>\nType 1<\/th>\nType 2<\/th>\nType 3<\/th>\n<\/tr>\n<\/thead>\n
Description<\/strong><\/td>\nIllegal Chinese-language casino websites<\/td>\nScambling (scam gambling) websites<\/td>\nPeckBirdy Chinese-language casino decoy sites<\/td>\n<\/tr>\n
Scale<\/strong><\/td>\nOver 1.7 million domains<\/td>\nThousands of domains<\/td>\nDozens of domains<\/td>\n<\/tr>\n
Audience (users & victims)<\/strong><\/td>\nMostly mainland Chinese players and money-laundering groups, occasionally other languages<\/td>\nGlobal, mostly non-Chinese-language<\/td>\nNo real users (decoy)<\/td>\n<\/tr>\n
Real gambling<\/strong><\/td>\nLargely yes<\/td>\nNo, it\u2019s rigged\/can\u2019t cash out<\/td>\nNo, it\u2019s set dressing<\/td>\n<\/tr>\n
Purpose<\/strong><\/td>\nIllegal gambling and money laundering<\/td>\nConsumer fraud<\/td>\nEspionage, intrusion, malware C2<\/td>\n<\/tr>\n
Operators<\/strong><\/td>\nTriad-aligned syndicates, casino junket-adjacent groups<\/td>\nNumerous threat actors<\/td>\nChina-aligned APT actors<\/td>\n<\/tr>\n
Customer support<\/strong><\/td>\nReal and responsive; operators protect their reputation to keep players depositing<\/td>\nOftentimes real, scripted responses to tough questions, stalls withdrawals<\/td>\nNone: no real users<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 1. The three types of malicious casino websites tracked by Infoblox Threat Intel<\/p>\n

Type 1: Illegal Chinese-Language Casinos<\/h3>\n

The most prevalent type of online casino infrastructure\u2014the Chinese-language casino websites facilitating illegal gambling\u2014is now a load-bearing component of transnational organized money laundering. It supports the movement of money out of China and other Asian jurisdictions to avoid taxes and oversight, and North Korea uses it to launder proceeds from its online criminal operations. These Chinese-language online casinos are one leg of the Asian underground banking economy operating across over 1.7 million domains. But as we explain throughout this research, these websites are being registered and hosted with U.S. and European companies, many for long periods of time.<\/p>\n

Infoblox Threat Intel has been tracking gambling operations intensively since uncovering Vigorish Viper<\/strong><\/a> and their sponsorships of European football teams in early 2024. In July 2026, the United Nations Office on Drugs and Crime (UNODC) published a new regional threat assessment for Southeast Asia titled \u201cAn Interconnected Criminal Ecosystem: Transnational Organized Crime Threat Assessment for Southeast Asia 2026.<\/strong><\/a>\u201d UNODC concluded that illegal online gambling is no longer a standalone problem for gambling regulators. Its convergence with cyber-enabled fraud, underground banking and human trafficking has made it a primary revenue source and operational enabler for organized crime across the region.<\/p>\n

UNODC estimated global illegal betting revenue up to $1.7 trillion annually, much of it serviced by criminal infrastructure based in Southeast Asia. Separately, they estimated losses from transnational online scam operations across East Asia, Southeast Asia, Australia, and New Zealand at $88.3 billion to $114.1 billion for 2025 alone<\/strong>, roughly three times the $18\u201337 billion estimated for 2023. UNODC described the underlying shift as syndicates moving from territorially rooted, single-specialty crime toward an integrated, service-based criminal economy, with laundering, trafficking, smuggling and data harvesting operating as specialized departments plugged into one broader criminal ecosystem.<\/p>\n

In its case study on the Vault Viper<\/strong><\/a> network, UNODC found that vast numbers of seemingly independent Chinese-language gambling brands ultimately rely on a small number of backend platform providers, DNS infrastructure clusters, and payment processing systems. The footnote on that passage cites our original 2025 research, “Vault Viper: High Stakes, Hidden Threats.<\/strong><\/a>\u201d<\/p>\n

UNODC was explicitly pessimistic about blocking these underground casino threats one domain at a time. They described domain redirection as a standard operational practice for these groups: they maintain thousands of active domains and rotate to a new one whenever the current one is blocked. The report concludes that this makes domain blocking largely ineffective as a standalone measure. The UNODC report also highlighted that the Philippines ordered more than 7,000 illegal gambling websites blocked in 2024, which had limited effect and was described as \u201cpractical futility.\u201d<\/p>\n

At Infoblox we track Chinese-language casino domains based on specific actor groups but even across these segments we see what appears to be shared best practices, infrastructure and code.<\/p>\n

We track sixteen clusters of very different sizes, and a small number of them are behind the vast majority of these Chinese-language casino websites. The two largest clusters are the FUNNULL and Vigorish Viper networks\u2014associated with the bulletproof CDN infrastructure that these casinos launder their hosting through\u2014holding roughly 745,148 and 666,157 domains respectively, together about 81% of the population. A third actor holds another 265,469 domains, and a fourth holds 56,446 domains, bringing the top four to roughly 99.5% of every Chinese-language casino domain we track. The remaining actors, several now dormant, add up to only a few thousand domains between them. Most were tracked because of some unique behavior or infrastructure decision, which may in fact have been an A\/B test by one of the larger groups. See Table 2.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Actor (report label)<\/th>\nDomains<\/th>\nStatus<\/th>\n<\/tr>\n<\/thead>\n
FUNNULL CDN*<\/td>\n745,148<\/td>\nactive<\/td>\n<\/tr>\n
Vigorish Viper<\/td>\n666,157<\/td>\nactive<\/td>\n<\/tr>\n
Actor #3<\/td>\n265,469<\/td>\nactive<\/td>\n<\/tr>\n
Actor #4<\/td>\n56,446<\/td>\nactive<\/td>\n<\/tr>\n
Actor #5<\/td>\n2,632<\/td>\nactive<\/td>\n<\/tr>\n
Actor #6<\/td>\n1,858<\/td>\nactive<\/td>\n<\/tr>\n
Actor #7<\/td>\n1,072<\/td>\ndormant<\/td>\n<\/tr>\n
Actor #8<\/td>\n816<\/td>\nactive<\/td>\n<\/tr>\n
Actor #9<\/td>\n814<\/td>\ndormant<\/td>\n<\/tr>\n
Actor #10<\/td>\n667<\/td>\nactive<\/td>\n<\/tr>\n
Actor #11<\/td>\n491<\/td>\ndormant<\/td>\n<\/tr>\n
Actor #12<\/td>\n283<\/td>\ndormant<\/td>\n<\/tr>\n
Actor #13<\/td>\n179<\/td>\ndormant<\/td>\n<\/tr>\n
Actor #14<\/td>\n171<\/td>\ndormant<\/td>\n<\/tr>\n
Actor #15<\/td>\n83<\/td>\nactive<\/td>\n<\/tr>\n
Actor #16<\/td>\n72<\/td>\ndormant<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 2. The sixteen Chinese-language casino actors by domain count and current activity status. *FUNNULL CDN also hosts a small number of investment scam websites targeting the U.S. but the vast majority of their websites are Chinese-language casinos used for illegal gambling and money laundering.<\/p>\n

Throughout this report we\u2019ll talk broadly about this Chinese-language casino ecosystem, knowing that the vast majority of the sites are set up by two actors who make similar hosting decisions, and that our broader group of actors are also closely aligned.<\/p>\n

Gambling has been illegal for people in mainland China for decades. A March 2021 criminal law amendment<\/strong><\/a>, covered by some Asian gambling outlets, extended that prohibition: It\u2019s now also illegal to operate an overseas gambling establishment or to organize and solicit Chinese residents to use one. The amendment likely enabled the prosecution of SunCity Gaming executives in late 2021, including CEO Alvin Chau, who was sentenced to 18 years in a Chinese jail<\/strong><\/a> for facilitating over $100 billion in illegal bets.<\/p>\n

That prohibition and even the prosecution of an executive running one of these networks did not remove demand or the willingness to serve the massive Chinese gambling audience. It did, however, move the entire Chinese gambling market into an even more underground economy served by murky Chinese operators whose money flows into better-known gambling brands that launder their reputation by sponsoring European football clubs. This laundering practice has been covered in previous Infoblox reports and extensively by \u201cPlayTheGame\u201d in their 2024 piece \u201cMeet the hydras: tracing the illegal gambling operators that sponsor football.<\/strong><\/a>\u201d<\/p>\n

The Chinese-language casino websites differ from the other two types in one important respect: they run real customer support. Their contact channels work. They process withdrawals. Many of the games probably run normal house odds, because the house edge already wins over time and because the operator’s real business depends on player trust. A player who cannot cash out stops depositing, and deposits are the pipeline the broader money laundering runs through.<\/p>\n

For most defenders, this is the counterintuitive part. They are working casino websites that happen to be illegal, run by operators who need them to keep working, because the deposits are what the laundering depends on.<\/p>\n

Recent Examples of Illegal Chinese-Language Casinos<\/h3>\n

Across the more than 1.7 million illegal Chinese-language casino sites we track, many are online for days or weeks.<\/p>\n

Some serve content directly, while others redirect visitors to unexpected hosts based on device details (IP address or perceived location, device type, and language). All the hosts are likely meant to be temporary because many of them are trying to facilitate illegal gambling in mainland China and face blocks and other dynamic restrictions from the Great Firewall of China.<\/p>\n

We track this complex ecosystem of gambling through several different methods.<\/p>\n

Some actors constantly spin up new sites with unique templates, visual layouts, and offers. We see a mix of classic casino games, slots, video games for money, sports gambling, stock investing, and some of them also mix in explicit adult offers. Other actors run near-identical websites with only cosmetic changes: switching out brands, graphics, and colors, but using identical offers and underlying language from site to site. On essentially every one of these sites you will find links to customer support portals, oftentimes hosted on new domains. These support portals are managed with a mix of stock responses, what appears to be AI chat bots, and likely human operators. Many of the systems require providing account IDs or account details when initiating a chat session, but not all.<\/p>\n

We\u2019re including a mix of examples below in Figures 2 through 6 to show both the diversity of sites and how often the same content appears under different branding. In all these examples it should be assumed that the brand being referenced, even if it\u2019s a real casino brand with a physical presence in Macau or elsewhere, is unlikely to have any actual association with the low-quality casino websites in this network. Most major casino brands found on these sites are being impersonated and are victims, too.<\/p>\n

<\/p>\n

Figure 2. Screenshot of a recently active site 11170011[.]com featuring \u201cVenetian Macao\u201d branding, translated into English. This is a classic illegal Chinese-language casino website with both casino games and \u201cvideo games for money\u201d\u2014simple games with gambling mechanics bolted on.<\/p>\n

<\/p>\n

Figure 3. Screenshot of a recently active site puqxr[.]com hosting a \u201cPoint 72\u201d Chinese investment platform featuring a wide range of Chinese stocks on the homepage and various incentives for signup. This Chinese brand is likely impersonating the real \u201cPoint72 Asset Management\u201d brand based in the U.S. We cannot confirm whether these investment sites are used for classic pig butchering schemes, which we would expect if they were in a different language.<\/p>\n


\n<\/p>\n

Figure 4. Screenshot of three recently active sites from left to right: 80074[.]cc, 11168833[.]com, 11170011[.]com, hosting essentially identical content and games but have different branding, logos and colors. It\u2019s common to find sites on these networks with minor differences like this.<\/p>\n

<\/p>\n

Figure 5. Screenshots of four recently active unique casino sites (from left to right): 312zym001[.]cc, am125[.]cc, 843470[.]cc, 1862[.]cc. The fourth (1862[.]cc) redirects to raw IPs based on location as seen in the videos below. It\u2019s still common to find some Chinese-language casino threat actors who spin up numerous versions of their sites. The site on the far right included a fake image of basketball superstar Steph Curry on their homepage, alluding to an endorsement. We found no evidence that Steph Curry has an association with this site; the image was very likely created and used without his authorization.<\/p>\n

<\/p>\n

Figure 6. A closer view of the screenshot of Steph Curry embedded into the low-quality casino website associated with 1862[.]cc<\/p>\n

When accessing the domain 1862[.]cc with the fake Steph Curry endorsement, a series of redirects fingerprinted the visitor\u2019s IP address and device, then sent them to a unique IP address hosting an exact copy of the site.<\/p>\n

When trying to visit 1862[.]cc while using a Hong Kong IP address, the site redirected to a final destination IP address, 157[.]185[.]143[.]150, hosting the website.<\/p>\n

\n