six-slots[.]com

This domain, six-slots.com, was registered on 2025-08-03 through Porkbun LLC and subsequently used to host a counterfeit site that mimics the Blast brand. The page title observed at the time of analysis reads “SIX-SLOTS | Enter the world of sport and stakes!”, indicating a focus on gambling. The underlying infrastructure is hosted on an OVH SAS server in Germany (AS16276) at IP address 57.129.97.29, and the domain resolves to that address without presenting a TLS certificate. Authoritative name servers are dane.ns.cloudflare.com and daphne.ns.cloudflare.com, confirming the use of Cloudflare DNS services.

Malware and phishing detection services on VirusTotal reported 11 of 95 scanners flagging the domain, reflecting a moderate detection rate. The site appears on a single external blocklist and has been actively blocked by the PhishDestroy remediation service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The observed kit is identified as the “Gambler Scam” and the campaign is categorized as a crypto-gambling scam, consistent with the brand-impersonation intent.

While the HTTP response and any credential-capture functionality have not been captured in this report, the available evidence—particularly the flagged vendor count, blocklist presence, low trust score, and hosting characteristics—strongly suggests an active threat. Defenders should add the IP 57.129.97.29 and the domain six-slots.com to deny-list rules, enforce DNS filtering for the associated Cloudflare name servers, and monitor for any residual traffic. Because the site is currently offline, ongoing observation of the registrar and hosting provider for re-registration attempts is advisable. Additional investigation of the kit components and any related command-and-control infrastructure would further clarify the campaign scope.