betpas-week[.]com

Analysis of betpas-week.com, observed on July 25, 2026, indicates that the domain was used for a crypto gambling phishing campaign and is currently taken offline. The domain was registered on February 23, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 172.67.162.164, which is associated with AS13335 in the United States. DNS resolution is serviced by Clara.ns.cloudflare.com and Keenan.ns.cloudflare.com, confirming the use of Cloudflare's infrastructure and HTTP/3 support. The site presented the page title "BETPAS GÜNCEL GİRİŞ, BETPAS SLOT & CANLI CASİNO, BETPAS BONUS FIRSATLARI," suggesting a focus on Turkish‑language gambling services and aligning with the identified Gambler Scam phishing kit.

The SSL certificate was issued by Google Trust Services under the WE1 identifier, providing a legitimate‑looking TLS layer that may aid in social engineering. Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist, while PhishDestroy has already blocked it. VirusTotal analysis recorded detections by two of ninety‑three scanning engines, reinforcing the malicious classification.

The combination of a low trust score, limited blocklist presence, and partial VirusTotal detections suggests the campaign was in an early or low‑volume stage before being shut down. Defenders should add betpas-week.com and its resolving IP 172.67.162.164 to deny‑list rules, monitor for newly‑registered domains using the same registrar or similar naming patterns, and update intrusion detection signatures to flag the Gambler Scam kit indicators. Continuous observation of Cloudflare‑hosted IP ranges for similar phishing payloads is recommended to mitigate re‑use of the infrastructure.