play[.]kuofax[.]com

Analysis of play.kuofax.com shows a high‑risk, active brand‑impersonation campaign targeting users of crypto casino and gambling services. The domain was created on 2026-06-08 and immediately points to a Cloudflare‑managed address (172.67.166.94, AS13335, United States). HTTP requests return a 200 status and the page title advertises "Kuofax: Most Popular Online Crypto Casino Based on Blockchain," confirming the intended brand context. Infrastructure checks reveal Cloudflare Browser Insights, HTTP/3 support, and the SSL certificate issued by Google Trust Services under the WE1 profile, indicating a legitimate TLS endpoint but not mitigating the malicious intent. The site is listed on a single security blocklist and is blocked by PhishDestroy; Gridinsoft assigns it a trust score of 0/100. VirusTotal reports that 12 of 91 scanners flag the domain, and Google Safe Browsing categorises it under SOCIAL_ENGINEERING, reinforcing the phishing nature. Registration details reference Fewmoretaps OU d/b/a Trustname.com, a pattern seen in other fraudulent operations. The domain is associated with the publicly known "Gambler Scam" phishing kit, suggesting reuse of template code for credential harvest or payment redirection. While the exact payload and page content have not been examined, the convergence of brand‑specific page title, phishing kit attribution, and multiple vendor detections provides strong evidence of malicious activity. Defenders should block the domain at perimeter firewalls, update URL filtering policies, and monitor DNS queries for the associated IP and nameservers (emerson.ns.cloudflare.com, thea.ns.cloudflare.com). Continuous threat‑intel feeds should be consulted for any emerging indicators tied to the Gambler Scam kit, and compromised credential reports should be correlated with this infrastructure to assess potential impact.