playamo[.]co[.]com

Analysis on July 24 2026 indicates that the domain playamo.co.com remains active and is being used for a high‑risk brand‑impersonation campaign targeting Mastercard. The site presents the page title “PlayAmo Deutschland | Offizieller Casino Login Link” and is built on WordPress running on Ubuntu with Nginx, MySQL and PHP, with HTTP Strict Transport Security enabled. The server resolves to 38.180.23.203, an address located in Austria and assigned to AS9009 (M247 Europe SRL). The TLS certificate is issued by Let’s Encrypt (R13), providing only baseline encryption without authentication of the owner.

The domain was originally registered on 16 August 1997 through Moniker Online Services LLC and continues to use the default name servers ns1‑ns4.nic.co.com. Reputation checks show a Gridinsoft trust score of 0 / 100 and two of ninety‑one VirusTotal scanners have flagged the host. The address appears on four public blocklists – PhishDestroy, Polkadot, Enkrypt and Codeesura – confirming its malicious classification. Malware analysis attributes the site to the “Gambler Scam” phishing kit, consistent with the reported crypto‑gambling theme.

While the HTTP response code is 200, the content has not been publicly dissected, leaving the exact credential‑capture mechanisms unknown. Defenders should block the domain and its resolving IP at perimeter firewalls, update DNS filtering feeds with the four listed blocklists, and monitor for outbound traffic to the host. Additional steps include scanning internal logs for any connections to 38.180.23.203, enforcing multi‑factor authentication for Mastercard‑related services, and employing threat‑intel platforms to correlate any observed use of the Gambler Scam kit with this infrastructure. Continuous re‑evaluation is advised, as the campaign may evolve its hosting or kit components.