fqrt808game[.]com

Analysis of fqrt808game.com shows a short‑lived infrastructure that was used to impersonate the Camelot brand in a crypto‑gambling context. The domain was registered on August 29, 2025 through Atak Domain and resolves to the IP address 172.67.152.127, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Both authoritative name servers are hosted on Cloudflare (james.ns.cloudflare.com and margaret.ns.cloudflare.com), indicating that the attacker leveraged a reputable CDN to obscure origin details. No TLS certificate was observed for the site, and the HTTP service was taken offline at the time of reporting, consistent with a rapid takedown or abandonment.

The only visible content retrieved before shutdown displayed the page title "Kent Casino," a generic casino reference that does not match the targeted brand. VirusTotal recorded a single positive detection out of 95 scanned scanners, and Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious classification. The domain appears on one external security blocklist and has been explicitly blocked by PhishDestroy. The underlying phishing kit is identified as the "Gambler Scam" package, which is commonly used for crypto‑gambling fraud.

While the infrastructure details such as the hosting provider are clear, the exact payload delivery method and any associated command‑and‑control endpoints remain unknown due to the domain’s offline status. Defenders should continue to monitor Cloudflare‑originated IPs for similar patterns, enforce blocklist rules for fqrt808game.com and its associated IP, and consider adding the domain to internal URL filtering policies. Threat intelligence feeds should be updated to reflect the confirmed impersonation of Camelot and the association with crypto‑gambling scams, enabling early detection of future replicas that may use the same hosting or kit components.