gambed[.]cc

Analysis of gambed.cc indicates an active phishing domain targeting users of online cryptocurrency gambling platforms. The domain was registered on April 2, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 12, 2026. The page title, 'Gambed: Most Popular Online Crypto Casino Based on Blockchain,' explicitly positions the site as a blockchain-based gambling service, a common lure in phishing campaigns designed to exploit users seeking high-risk financial activities. Infrastructure analysis reveals the domain resolves to IP address 104.21.72.223, a Cloudflare-hosted endpoint, which is frequently utilized to obscure malicious infrastructure. The site employs Cloudflare Browser Insights and integrates tracking technologies such as Twitter Ads and Facebook Pixel, suggesting an effort to mimic legitimate marketing practices while potentially harvesting user data. The SSL certificate is issued by Let's Encrypt, a neutral indicator that does not mitigate the domain's malicious classification. Threat intelligence confirms the domain is associated with the 'Gambler Scam' phishing kit, a known framework for fraudulent gambling schemes. Security vendors have flagged gambed.cc in 17 of 95 scans, and it appears in four threat intelligence pulses on AlienVault OTX. The domain is currently blocked by PhishDestroy and is listed on one security blocklist. Gridinsoft assigns a trust score of 1 out of 100, further corroborating its high-risk status. Defenders should treat this domain as a confirmed phishing threat. Network-level blocking is recommended, particularly for organizations with exposure to cryptocurrency or gambling-related traffic. While the exact content and functionality of the site remain unanalyzed, the combination of infrastructure indicators, threat intelligence, and known phishing kit association provides sufficient evidence to classify gambed.cc as a high-risk domain.