king-play[.]cc

The domain king-play.cc was registered on 2026-03-05 through Gname.com Pte. Ltd. and is served from the Cloudflare network (AS13335) with the IP address 104.21.6.24. Its authoritative nameservers are georgia.ns.cloudflare.com and rocco.ns.cloudflare.com, indicating a standard Cloudflare front‑end configuration.

The site presents a page titled “King-play: Most Popular Online Crypto Casino Based on Blockchain” and explicitly impersonates the brand Base. Analysis of the page content matches the publicly available “Gambler Scam” phishing kit, a template commonly used to harvest credentials for cryptocurrency gaming services. The domain is listed on one security blocklist and has been flagged by PhishDestroy, reinforcing its malicious intent.

Security tooling assigns a Gridinsoft trust score of 0 / 100 and VirusTotal reports 13 of 95 scanners flagging the domain, a clear indication of widespread detection. The site serves a valid Let’s Encrypt certificate (E7) and returns HTTP 200, which can aid in bypassing naïve content filters. Embedded tracking scripts such as Twitter Ads, Facebook Pixel, and Cloudflare Browser Insights reveal an intent to monitor visitor interaction for credential collection.

While the current evidence confirms brand impersonation and the use of a known phishing kit, the exact data exfiltration mechanisms remain unobserved; no payload samples or captured credential logs are publicly available. Nevertheless, the combination of a fresh registration, low trust score, active blocklist status, and active hosting suggests a high‑confidence malicious operation.

Defenders should add king-play.cc to network blocklists, enforce DNS sinkholing, and monitor outbound connections to the associated Cloudflare IP. Additional scrutiny of traffic targeting the site’s tracking pixels may reveal victim interaction patterns. Continuous re‑evaluation is advised, as the infrastructure could be repurposed for broader crypto‑related fraud campaigns.