Low-quality casino sites conceal highly dangerous threat actors

If your employees are visiting Chinese-language gambling or adult sites, they may not just be wasting time and money, but potentially encountering serious malware hidden behind domains that look like mostly harmless entertainment at first glance.

A report from Infoblox urges the security community to pay closer attention to these websites, because some double as command-and-control (C2) infrastructure for espionage and malware distribution.

Zach Edwards, staff threat researcher at Infoblox, suggests security researchers and the media have ignored these sites because the story is complicated and confusing.

Infoblox says it tracks about 1.7 million Chinese-language casino websites that facilitate illegal gambling.

These support North Korean money laundering and tax avoidance, among other dubious activities.

And these casino sites can be difficult to distinguish from one another.

They tend to use variations of common templates in terms of design and function.

Many operate like a legal casino would, just relying on the advantage of house odds to profit.

While these sites provide illegal gambling and adult entertainment for online visitors from China and Asia, some rely on US cloud providers for computing infrastructure.

"Major US hosting companies (Amazon, Microsoft, Cloudflare, and Google) continue to host infrastructure associated with these domains," the Infoblox report explains.

"One likely explanation is account theft at those providers, a practice documented previously as 'infrastructure laundering.'" That refers to hosting companies like Funnull that have reportedly rented IP addresses from Amazon Web Services and Microsoft and made those resources available to clients carrying out illegal activities.

According to a July 2026 report from the UN Office on Drugs and Crime (UNODC), disparate crime syndicates increasingly use common infrastructure for cybercrime, while online scams resulted in estimated losses of between $88.3 billion and $114.1 billion in 2025 across East Asia, Southeast Asia, Australia, and New Zealand.

A subset of casino sites offer scam gambling, or "scambling." Visitors place bets but can't get their money out if they win.

And then there's a subset of sites used by China-aligned threat groups.