netcas[.]click

The domain netcas.click was registered on April 28, 2026 through Global Domain Group LLC. Within hours of registration it began serving HTTP content and obtained a TLS certificate from Google Trust Services issued to the WE1 trust store. The site is currently reachable, returning HTTP 200 responses, and is listed as active. Infrastructure analysis shows the domain is hosted behind Cloudflare’s network, resolving to IP address 104.21.2.88, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. Authoritative nameservers are algin.ns.cloudflare.com and sarah.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The public page presents the title “Netcas - Crypto Games | Crypto Gambling”, indicating a lure toward cryptocurrency gambling services. Classification systems have labeled the site as a generic phishing operation, and it appears on one external blocklist. The domain is also flagged by PhishDestroy, reinforcing the phishing assessment. Risk metrics further underline the threat: Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports 14 of 95 security vendors flagging the domain as malicious. These indicators, combined with the high‑risk rating and the active status, justify a high confidence that the domain is being used to harvest credentials or financial information. Defenders should immediately block netcas.click at network perimeter and DNS layers, and consider sinkholing the associated Cloudflare IP address to disrupt traffic. Continuous monitoring of the Cloudflare IP range for similar patterns is advised, as well as updating email filtering rules to catch references to crypto gambling lures. Threat intelligence feeds should be refreshed to include the domain’s identifiers, and any compromised accounts should be examined for signs of credential reuse.