bobxcas[.]cfd

Analysis of bobxcas.cfd shows a confirmed crypto‑gambling phishing operation that was taken offline prior to the report date of July 24, 2026. The site presented the page title “Bobxcas: Crypto Casino Games & Crypto Gambling,” indicating a focus on cryptocurrency‑based casino services. Registration data reveal the domain was created on February 21, 2026 through Web Commerce Communications Limited, and it resolves to the IP address 188.114.97.3, which is part of Cloudflare’s AS13335 network and geolocated to the United States. The domain uses the Cloudflare nameservers clay.ns.cloudflare.com and leah.ns.cloudflare.com, and it does not present an SSL certificate, leaving the connection unencrypted.

Malware scanning on VirusTotal recorded two detections out of 93 security vendors, confirming malicious activity. The site is listed on one public blocklist and is actively blocked by the PhishDestroy service, further corroborating its phishing nature. The phishing kit identified is the “Gambler Scam,” a known template for crypto gambling fraud.

While the site is currently offline, the infrastructure—particularly the Cloudflare‑hosted IP and the absence of TLS—remains a potential vector for future campaigns. Defenders should continue to block the domain and its associated IP, monitor for re‑registration or use of the same hosting assets, and add the domain to internal URL filtering and threat intelligence feeds. Continuous observation of Cloudflare‑owned address space for similar patterns is advised, as the kit may be redeployed under new domains.