gamecas[.]at

On July 23, 2026, analysis of the domain gamecas.at confirms that it is being leveraged for a crypto‑casino phishing operation. The site resolves to the IP address 172.67.168.207, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by the Cloudflare nameservers mustafa.ns.cloudflare.com and rayne.ns.cloudflare.com, indicating that the infrastructure is fully hosted behind Cloudflare’s edge network. The site presents an HTTP 200 response and serves a valid TLS certificate issued by Let’s Encrypt (R12), demonstrating that the attacker has taken steps to appear legitimate to browsers. The page title, "Gamecas: Most Popular Online Crypto Casino Based on Blockchain," directly references a cryptocurrency gambling service, aligning with the classified scam type of a crypto scam and the identified Gambler Scam phishing kit.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 / 100, and Gridinsoft also reports a score of 1 / 100. The domain is listed on one security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis shows that 16 of 95 scanning engines flag the domain as malicious, reinforcing the high confidence that the site is malicious. No further public intelligence, such as additional blocklist entries or Safe Browsing data, is available at this time.

The domain is currently offline, which may indicate a temporary takedown or a shift in the attacker’s infrastructure. Defenders should continue to monitor the IP address 172.67.168.207 and the associated Cloudflare nameservers for re‑appearance, enforce outbound filtering for the "gamecas.at" domain, and ensure that any internal references to crypto‑casino services are scrutinized.