x-egamb[.]com

This domain, x-egamb.com, is identified as a credential harvesting phishing site specifically targeting users of online eGaming platforms. Analysis indicates the domain is currently offline, though prior activity suggests it was designed to mimic legitimate gaming portals to capture login credentials and personal information. The threat type is classified as a fake login portal with elevated risk due to its targeted approach and infrastructure characteristics. Infrastructure analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.18.207, which is hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged by 18 of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate, identified as WE1, further indicates the use of automated or low-trust encryption practices. The domain's registration details and hosting provider suggest an attempt to leverage Cloudflare's proxy services to obscure its true origin and evade detection. Current status confirms the domain has been taken offline, likely due to enforcement actions or infrastructure changes. However, the elevated risk assessment remains valid due to the domain's recent activity and the persistent threat posed by similar credential harvesting campaigns. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for related domains registered through the same registrar or utilizing similar Cloudflare-hosted infrastructure. End-users should be educated on recognizing phishing attempts, particularly those impersonating eGaming platforms, and encouraged to verify domain authenticity before entering credentials. Proactive threat hunting for indicators of compromise, such as unusual login attempts or unauthorized access, is recommended for entities in the gaming sector.