marscas[.]com

Analysis of marscas.com, which was taken offline as of the report date, reveals a deliberately crafted cryptocurrency‑focused phishing operation. The domain resolves to IP 69.5.189.56, an address hosted in Switzerland and assigned to ASN 42624 (Global-Data System IT Corporation). The registration record shows the domain was created on July 15, 2025 and was filed through MAT BAO CORPORATION, indicating a relatively recent establishment typical of fast‑moving scam infrastructure. The site was served without an SSL certificate, exposing all traffic in clear text and facilitating credential capture. The page title observed in the HTTP response is "MARSCAS | Play at the best online casino based on Blockchain," which aligns with the declared scam type of a crypto‑based gambling lure.

Further, a known Gambler Scam phishing kit has been linked to the domain, confirming the use of a pre‑built fraudulent template targeting users interested in blockchain casino services. Reputation checks show a Gridinsoft trust score of 1 out of 100, reflecting an extremely low credibility rating. VirusTotal analysis records two of ninety‑five security vendors flagging the domain, and the domain appears on a single external blocklist. It has also been listed by PhishDestroy as a blocked resource.

Nameservers ns1.nameserverhub.com and ns2.nameserverhub.com are in use, a common configuration for disposable or rapidly redeployed malicious sites. While the site is currently offline, the combination of a low trust score, lack of TLS, the specific phishing kit attribution, and active blocklist listings provide strong evidence of a malicious intent. Defenders should continue to block the domain and its associated IP address at network perimeters, ingest the indicator into threat intelligence platforms, and monitor the hosting provider and name server pair for potential re‑use.