playzoreel[.]live

playzoreel.live was registered on 26 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain is delegated to the Cloudflare nameservers aron.ns.cloudflare.com and kyree.ns.cloudflare.com and resolves to the IP address 172.67.159.102, which is part of the Cloudflare network (AS13335) located in the United States. No TLS certificate was observed for the site, indicating that HTTPS was not offered at the time of analysis. The landing page title reads “Playzoreel: Most Popular Online Crypto Casino Based on Blockchain,” suggesting a cryptocurrency‑focused gambling lure.

The threat profile is listed as a generic phishing campaign with a specific classification of crypto scam, and the underlying infrastructure matches the publicly known “Gambler Scam” phishing kit. Reputation checks show the domain appears on a single security blocklist and has been flagged by eight of ninety‑three VirusTotal scanners. PhishDestroy has also recorded the domain as blocked. Current infrastructure status is reported as offline, which may be a temporary takedown or a deliberate shutdown after a short campaign run.

The limited blocklist presence and modest vendor detection count suggest a low‑visibility campaign, yet the use of a reputable hosting provider and a convincing crypto casino narrative increase the potential impact against users seeking high‑return gambling services. While the available data confirms the malicious intent and basic technical footprint, details such as the exact payload, credential harvesting mechanisms, or victim targeting patterns have not been publicly disclosed. Defenders should add 172.67.159.102 to network‑level blocklists, deny traffic to playzoreel.live at DNS and HTTP layers, and monitor for future re‑registration attempts. Ongoing surveillance of Cloudflare‑hosted domains that share the same nameserver set or exhibit similar page titles is advised, as the same kit may be repurposed under different domains.