TLDR
- Cybersecurity firm Infoblox is tracking more than 1.7 million domains tied to Chinese-language illegal casino activity.
- Operators constantly rotate domain names, so blocking one site has little effect on the wider network.
- A recently active site used the Venetian Macao name without any real connection to the resort.
- Infoblox sorted suspicious sites into three groups: illegal gambling platforms, fake casinos, and decoy pages hiding cyberespionage tools.
- Just two networks account for about 81% of the tracked domains, showing the activity is controlled by a small number of groups.
Cybersecurity company Infoblox says it is tracking more than 1.7 million domains linked to Chinese-language illegal casino activity. The company published its findings on September 15.
Infoblox said the domains are part of an online network aimed mostly at mainland Chinese players. Money-laundering groups are also tied to the activity.
The 1.7 million figure does not mean there are 1.7 million separate gambling operators. It also doesn’t mean there are that many unique websites either.
How the Networks Stay Online
According to Infoblox, the groups behind these sites keep creating new domain names on a rolling basis. When one address gets blocked, operators simply redirect users to another one from their pool.
This setup makes it hard to pin down how many operators are actually behind the activity. It also means blocking a single site does little to slow down the larger network.
Infoblox found one recently active domain using the Venetian Macao name next to casino and gambling-style games. The company said there is no evidence the site has any real link to the Venetian Macao resort.
Infoblox explained that big casino brands showing up on shady sites are usually not connected to the actual operation. The real companies are typically victims of brand misuse, not participants in it.
Using a well-known casino name can make a fake site look more trustworthy to visitors. Infoblox’s research found no proof that the Venetian Macao branding it identified was tied to the genuine resort in any way.
The report did not list other casino brands that may have shown up on the tracked domains.
Three Categories of Suspicious Sites
Infoblox broke the suspicious sites into three separate categories. The first covers platforms that support illegal gambling and money laundering, and it’s this group that makes up the 1.7 million domain count.
The second category is made up of fake casinos built to stop users from withdrawing their money. These sites look like gambling platforms but are really designed to trap funds.
The third category covers casino-themed pages used as a cover for cyberespionage tools. These pages exist to hide technical infrastructure rather than to take bets.
Infoblox separated the categories because each type serves a different purpose. Some move illicit money, others scam customers directly, and others hide spying tools behind a gambling theme.
The 1.7 million domain figure applies only to the first group. It does not include the fake casino sites or the decoy pages used for cyberespionage.
Despite the large number of domains, Infoblox said the activity traces back to a small number of technical networks. Two networks alone account for around 81% of the tracked Chinese-language casino domains.
The four largest clusters make up about 99.5% of the total. That means nearly all 1.7 million domains link back to a small group of operators.
This concentration helps explain how these networks keep such large pools of backup domains ready to go. Instead of depending on a handful of websites, operators can shift users between huge batches of addresses whenever one gets shut down by authorities or internet providers.
