ganobet-giris[.]cam

Analysis of the domain ganobet-giris.cam indicates an active credential-phishing campaign targeting users of online gambling platforms. The domain was registered on June 21, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 104.21.36.43, hosted on Cloudflare's network (AS13335) in Canada, and utilizes Cloudflare nameservers (saanvi.ns.cloudflare.com, valentin.ns.cloudflare.com). The use of Cloudflare services is consistent with phishing operations seeking to obscure hosting origins and evade takedowns. The domain is flagged by one security blocklist and appears in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. Four of ninety-one security vendors on VirusTotal detect the domain as malicious, providing additional corroboration of its phishing classification. The SSL certificate, issued by Google Trust Services (WE1), is legitimate but does not mitigate the domain's fraudulent intent, as phishing sites commonly leverage valid certificates to appear trustworthy. The page title 'Just a moment...' and HTTP 403 status indicate the site may be employing anti-bot measures or awaiting activation, a tactic observed in credential-harvesting campaigns to delay detection. The scam type is explicitly categorized as credential phishing, though the specific gambling brand being impersonated is not confirmed in available data. Defenders should prioritize blocking the domain and associated IP (104.21.36.43) at network and endpoint levels. Monitoring for newly registered domains under the same registrar or utilizing identical Cloudflare infrastructure may aid in identifying related threats. The domain remains active as of July 12, 2026, and poses a high risk to users.