dafygode[.]com

On July 24 2026 a technical investigation was conducted for the domain dafygode.com. The domain was registered on August 04 2025 through Key-Systems GmbH and currently resolves to the IP address 172.67.189.91, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative nameservers lilith.ns.cloudflare.com and quincy.ns.cloudflare.com. No TLS certificate is present, indicating that HTTPS is not configured. The site’s page title, as captured before takedown, reads "DAFYGODE | Play at the best online casino based on Blockchain", aligning with a crypto‑focused gambling lure. Intelligence sources label the campaign as a "Crypto Scam" using the publicly known "Gambler Scam" phishing kit.

Reputation services assign extremely low trust scores: Scamadviser reports 1/100 and Gridinsoft also reports 1/100. The domain appears on a single security blocklist and is listed in one AlienVault OTX pulse. VirusTotal analysis shows that seven of ninety‑five scanned security vendors flagged the domain as malicious. The domain has been actively blocked by the PhishDestroy service and is currently offline. Evidence confirms that the infrastructure leverages Cloudflare’s edge network, a common tactic to hide origin servers and benefit from legitimate traffic.

The absence of TLS and the low reputation scores suggest a lack of investment in legitimacy. While the page title and kit identification provide reasonable confidence that the operation targeted victims interested in blockchain‑based gambling, no additional payload or credential‑capture details were observed. Defenders should add dafygode.com to URL filtering, block the associated IP 172.67.189.91, and monitor for any sub‑domains that may resolve to the same Cloudflare address range. Threat‑intel feeds should be updated to reflect the domain’s association with the Gambler Scam kit and its classification as a crypto scam.