rolleus[.]com

Analysis of rolleus.com, observed as offline on July 24, 2026, indicates a high‑confidence credential‑theft operation targeting the foundation brand. The domain was registered on July 9, 2025 through MAT BAO CORPORATION and resolves to the IP address 69.5.189.54, which is assigned to AS42624 Global‑Data System IT Corporation in Switzerland. No TLS certificate is present, meaning the site would have been served over plain HTTP if reachable. The page title extracted from the cached snapshot reads “ROLLEUS | Play at the best online casino based on Blockchain,” aligning with the reported crypto‑scam classification and the Gambler Scam phishing kit.

VirusTotal records show that 2 of 95 scanning engines flagged the domain, providing independent vendor corroboration of malicious intent. AlienVault OTX lists the domain in a single threat‑intel pulse, and it appears on one public security blocklist, reinforcing its reputation as a malicious resource. Additional reputation data from Gridinsoft assigns a trust score of 1 out of 100, the lowest possible rating, and PhishDestroy has actively blocked the domain. Nameserver information (ns1‑ns4.nameserverhub.com) is consistent with a generic hosting service and does not appear to be tied to the legitimate foundation infrastructure.

Given the convergence of brand impersonation, crypto‑focused lure, low trust scores, vendor detections, and blocklist presence, defenders should treat rolleus.com as a confirmed malicious actor. Recommended actions include adding the domain and its resolving IP to network deny lists, updating URL filtering policies to block the identified nameservers, and monitoring for any future re‑registration attempts. Security teams should also enrich detection signatures with the observed page title and the Gambler Scam kit fingerprint to improve early identification of related campaigns.