7 minhigh
How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage
China-aligned APT groups hide PeckBirdy C2 infrastructure behind Chinese-language casino and adult websites, with key C2 domains having zero VirusTotal detections as of August 2026. PeckBirdy C2 framework operates since 2023, embedding malware C2 domains inside Chinese-language casino and adult websites to evade detection. Three C2 domains (cache-cdn.org, cache-mcp.com, mcp-source.online) had 13, 3, and 0 VirusTotal detections respectively. Over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain. Education, IT, banking, and government sectors are top targets.
Sens:■ Immediate
IOCs39
36domain2ip1url
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block PeckBirdy C2 domains: cache-cdn.org, cache-mcp.com, mcp-source.online, githubassets.net at DNS resolver
- Hunt networks resolving 3+ distinct PeckBirdy C2 domains for potential compromise
- Review DNS logs for mcp-source.online which has zero VirusTotal detections
- Investigate Chinese-language casino domain alerts as potential C2 before closing as browsing violations
Key Takeaways
- PeckBirdy C2 domain mcp-source.online had zero VirusTotal detections as of August 2026
- Over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain
- Resolving 3+ distinct PeckBirdy C2 domains from one network indicates likely compromise
- 1.7M+ illegal Chinese-language casino domains tracked across 16 actor clusters
- Scambling sites doubled in 2026 compared to 2025, targeting global non-Chinese audiences
Attack Chain
- Infrastructure Setup: China-aligned APT groups register Chinese-language casino and adult website domains as decoys
- Masquerading: Decoy websites display functional casino content to avoid defender scrutiny
- C2 Delivery: Casino pages load JavaScript payload from PeckBirdy C2 domains via script tags
- C2 Communication: Malware establishes WebSocket connections to mcp-source.online for data exfiltration
- Detection Evasion: C2 domains rotate frequently; multiple distinct C2 domain resolutions indicate compromise
Affected Systems
- Enterprise networks across Asia-Pacific region
- Education sector institutions (17.5% of affected customers)
- IT consulting organizations (15% of affected customers)
- Banking and financial services (10.5% and 6%)
- Government agencies (5% of affected customers)
- Web browsers loading Chinese-language casino or adult content
Detection Availability
- Published: Other detection logic
- Platforms: URLscan query, GitHub repo
URLscan query for cache-mcp.com C2 domain and GitHub repo with IOC list available.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | C2 operates via DNS resolution and WebSocket connections; minimal endpoint artifacts |
| Network Visibility | Medium | DNS queries to C2 domains and WebSocket connections visible on network logs |
| Detection Difficulty | Hard | C2 domains have zero to low VT detections; hidden in legitimate casino traffic |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Networks resolving 3+ distinct PeckBirdy C2 domains indicate compromise (T1071.001) | DNS resolution logs | Command and Control | Low — multiple C2 domains unlikely coincidental |
| WebSocket connections to mcp-source.online or a1.mcp-source.online from enterprise hosts (T1071.001) | Web proxy and firewall logs | Command and Control | Low — domain has no legitimate purpose |
| JavaScript loading from cache-mcp.com or cache-cdn.org on casino websites (T1105) | Web proxy logs | Execution | Medium — could resemble CDN traffic |
Required Log Sources
- DNS resolution logs
- Web proxy logs
- Firewall connection logs
- SIEM correlation events
- Network flow data
Key Behavioral Indicators
- Multiple distinct PeckBirdy C2 domain resolutions from same network
- WebSocket connections to mcp-source.online or subdomains
- JS service worker registration from Chinese-language casino domains
- Casino pages loading scripts from cache-mcp.com or cache-cdn.org
- Code functions my_bird_up(), my_bird_apprun(), appindex() in JS
- DNS queries to githubassets.net typosquat domain
Control Gaps
- DNS filtering alone insufficient due to rapid domain rotation
- VirusTotal has zero detections for mcp-source.online
- Automated web scanners miss WebSocket C2 connections
- Casino domains dismissed as employee browsing violations
False Positive Assessment
Medium — single PeckBirdy C2 domain resolution may reflect typosquatting (githubassets.net) or benign casino browsing; multiple distinct C2 domains significantly reduces false positive likelihood.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Implement DNS sinkholing for known PeckBirdy C2 domains
- Monitor WebSocket connections to low-reputation domains from enterprise networks
- Deploy DNS response policy zones to block casino C2 infrastructure
- Alert on multiple distinct C2 domain resolutions from single network segments
User Protection
- Train SOC analysts to investigate casino domain alerts before dismissal
- Block access to known scambling domains: dollycasino.com, dragobet.net, appcasino.online
- Alert on Chinese-language adult websites loading external JavaScript payloads
Security Awareness
- Educate analysts that casino domains may mask APT C2 infrastructure
- Brief teams on PeckBirdy campaign targeting education, banking, and government sectors
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Resource Development
Tactic
Execution
Tactic
Command and Control
Plain-Language Summary
Researchers found that online casino websites serve three purposes: illegal gambling with money laundering, fraudulent scam gambling sites that prevent cashouts, and hidden malware command servers for Chinese espionage groups. The espionage tool, called PeckBirdy, disguises its communication channels inside Chinese-language casino and adult websites. One key server had zero detections across 91 security vendors. Organizations in education, banking, and government are primary targets. Defenders should block the identified domains and investigate networks showing multiple connections to these servers.
Additional IOCs
- Ips:
157[.]185[.]143[.]150- Hosting IP for 1862.cc casino site, HK redirect target146[.]103[.]91[.]133- Hosting IP for 1862.cc casino site, JP redirect target
- Domains:
a1[.]mcp-source[.]online- PeckBirdy C2 subdomain for WebSocket data collection11170011[.]com- Illegal Chinese-language casino with Venetian Macao brandingpuqxr[.]com- Illegal Chinese-language investment platform impersonating Point7280074[.]cc- Illegal Chinese-language casino website11168833[.]com- Illegal Chinese-language casino website312zym001[.]cc- Illegal Chinese-language casino websiteam125[.]cc- Illegal Chinese-language casino website843470[.]cc- Illegal Chinese-language casino website1862[.]cc- Illegal casino redirecting to IP-based hosting by locationzzyud[.]com- Illegal Chinese-language casino websitezenplay77-x[.]space- Illegal Chinese-language casino website835gg[.]cc- Illegal Chinese-language casino domain from image evidence835[.]cc- Illegal Chinese-language casino domain from image evidence341[.]com- Illegal Chinese-language casino domain from image evidencepoqxr[.]com- Illegal Chinese-language investment site, variant of puqxr.com800074[.]cc- Illegal Chinese-language casino, variant of 80074.ccvns[.]cc- Illegal Chinese-language casino impersonating Venetian brand11160833[.]com- Illegal Chinese-language casino, variant of 11168833.com746[.]com- Illegal Chinese-language casino domain from image evidence312[.]je- Illegal Chinese-language casino domain from image evidence931[.]com- Illegal Chinese-language casino domain from image evidence843[.]app- Illegal Chinese-language casino domain from image evidence042[.]cc- Illegal Chinese-language casino domain from image evidence154[.]com- Illegal Chinese-language casino domain from image evidencedollycasino[.]com- Scambling site with 325% deposit bonus, cashout complaintsdragobet[.]net- Scambling site using blackhat SEO spam for promotionappcasino[.]online- Scambling site, redirect target of dragobet.netsummer138[.]fit- Scambling site with Joker branding, Indonesian/English mixstorebet77[.]support- Scambling site with Joker branding, uses Google logorealz[.]com- Scambling site offering 100% deposit bonus up to EUR100
- Urls:
hxxps://js[.]cache-mcp[.]com/layer.js- PeckBirdy JavaScript C2 payload URL loaded by decoy sites
- Other:
wss://${o}/?u=${encodeURIComponent(n)}&p=${encodeURIComponent(a)}&c=${encodeURIComponent(c)}- PeckBirdy C2 WebSocket communication pattern with user/pass/channel params8692e2a3ab9b45a4a4318960fca7d508- PeckBirdy JS identifier/key found in C2 payload code
Showing defanged values
- domain042[.]ccIllegal Chinese-language casino domain from image evidence
- domain11160833[.]comIllegal Chinese-language casino, variant of 11168833.com
- domain11168833[.]comIllegal Chinese-language casino website
- domain11170011[.]comIllegal Chinese-language casino with Venetian Macao branding
- domain154[.]comIllegal Chinese-language casino domain from image evidence
- domain1862[.]ccIllegal casino redirecting to IP-based hosting by location
- domain312[.]jeIllegal Chinese-language casino domain from image evidence
- domain312zym001[.]ccIllegal Chinese-language casino website
- domain341[.]comIllegal Chinese-language casino domain from image evidence
- domain746[.]comIllegal Chinese-language casino domain from image evidence
- domain800074[.]ccIllegal Chinese-language casino, variant of 80074.cc
- domain80074[.]ccIllegal Chinese-language casino website
- domain835[.]ccIllegal Chinese-language casino domain from image evidence
- domain835gg[.]ccIllegal Chinese-language casino domain from image evidence
- domain843470[.]ccIllegal Chinese-language casino website
- domain843[.]appIllegal Chinese-language casino domain from image evidence
- domain931[.]comIllegal Chinese-language casino domain from image evidence
- domaina1[.]mcp-source[.]onlinePeckBirdy C2 subdomain for WebSocket data collection
- domainam125[.]ccIllegal Chinese-language casino website
- domainappcasino[.]onlineScambling site, redirect target of dragobet.net
- domainasg78[.]comPeckBirdy decoy casino domain loading C2 payload
- domaincache-cdn[.]orgPeckBirdy C2 domain, 13/91 VT detections
- domaincache-mcp[.]comPeckBirdy C2 serving JS payload, 3/91 VT detections
- domaindollycasino[.]comScambling site with 325% deposit bonus, cashout complaints
- domaindragobet[.]netScambling site using blackhat SEO spam for promotion
- domaingithubassets[.]netPeckBirdy C2 typosquat mimicking GitHub asset hosting
- domainmcp-source[.]onlinePeckBirdy C2 WebSocket endpoint, zero VirusTotal detections
- domainpoqxr[.]comIllegal Chinese-language investment site, variant of puqxr.com
- domainpuqxr[.]comIllegal Chinese-language investment platform impersonating Point72
- domainrealz[.]comScambling site offering 100% deposit bonus up to EUR100
- domainstorebet77[.]supportScambling site with Joker branding, uses Google logo
- domainsummer138[.]fitScambling site with Joker branding, Indonesian/English mix
- domainvip311[.]ccPeckBirdy decoy casino domain embedding C2
- domainvns[.]ccIllegal Chinese-language casino impersonating Venetian brand
- domainzenplay77-x[.]spaceIllegal Chinese-language casino website
- domainzzyud[.]comIllegal Chinese-language casino website
- ip146[.]103[.]91[.]133Hosting IP for 1862.cc casino site, JP redirect target
- ip157[.]185[.]143[.]150Hosting IP for 1862.cc casino site, HK redirect target
- urlhxxps://js[.]cache-mcp[.]com/layer[.]jsPeckBirdy JavaScript C2 payload URL loaded by decoy sites
Stay currentSubscribe via RSS