firstgamb[.]com

firstgamb.com was observed as an elevated‑risk generic phishing site that impersonates an Elon Musk‑endorsed crypto casino. The page title returned by the live host reads “Firstgamb: Elon Musk’s Official Crypto Casino Powered by Blockchain,” indicating a direct attempt to leverage the Musk brand for a crypto‑scam campaign. The domain was registered on 2026-01-01 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv4 address 69.5.189.56, which is assigned to AS42624 Global-Data System IT Corporation in Switzerland (CH). The SSL certificate presented is identified as grade E7, which is below industry‑acceptable thresholds. Reputation services rate the domain poorly: Gridinsoft assigns a trust score of 28 / 100, while Scamadviser reports a score of 21 / 100.

VirusTotal analysis shows that 12 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. The site is currently offline, and it has been taken down by the PhishDestroy takedown service. It is listed on one external security blocklist and is actively blocked by PhishDestroy. The underlying malicious package has been classified as the “Gambler Scam” phishing kit, a known template used to lure victims into cryptocurrency investments or deposits. No additional page content has been captured, so the exact phishing flow, credential collection mechanisms, or redirect behavior remain unverified.

However, the combination of a low trust score, multiple vendor detections, and association with a known gambling‑themed kit strongly suggests that the domain was used to solicit crypto payments under the guise of an official Elon Musk casino. Defenders should add 69.5.189.56 to network‑level deny lists, block firstgamb.com at DNS and proxy layers, and monitor for any future re‑registration attempts. Updating intrusion‑detection signatures to include the observed page title and the “Gambler Scam” kit identifiers will improve detection of any copycat campaigns.