My question is;
1. Was Roobet.io ever used by Roobet casino before the decided to settle for Roobet.com?
2. If not, why not buy off that other domain (roobet.io) so that phishing scammers don't buy it and take advantage?
1. As I recall, Roobet casino started in 2019, and absolutely-positioned created this topic on November 08, 2019. However, roobet(.)io domain was registered in 2021, so I doubt it had ever been used by Roobet casino.
2. There are simply too many TLDs to buy them all. Phishing sites will always be possible, regardless. Even if they buy all the TLDs, the attacker can simply create a phishing site on rooobet(.)com, roobeet(.)com, or something like that, or the attacker can simply use Unicode instead of ASCII to mimic a real domain name.