bitstarz[.]poker

Analysis of the domain Bitstarz.poker, created on April 30, 2025 and currently taken offline, shows a clear pattern of malicious activity targeting cryptocurrency users. The site presented the page title "Bitstarz: Most Popular Online Crypto Casino Based on Blockchain," a phrasing that aligns with the listed scam type of a crypto scam and the Gambler Scam phishing kit. Registration was performed through NameCheap, Inc., and the domain resolves to the Cloudflare‑owned address 104.21.39.80, located in the United States under ASN 13335. The domain is served without an SSL certificate, indicating unencrypted HTTP traffic, which further reduces trust.

Infrastructure traces reveal the use of Cloudflare’s authoritative nameservers alla.ns.cloudflare.com and olof.ns.cloudflare.com, a common tactic for fast‑flux or content‑delivery masking. Security telemetry shows the domain appears on three independent blocklists, specifically PhishDestroy, MetaMask, and SEAL, confirming it has been flagged by multiple anti‑phishing services. VirusTotal scans report 14 of 95 security vendors labeling the domain as malicious, reinforcing the consensus of risk. Gridinsoft’s trust score of 0 out of 100 provides an additional quantitative indicator of its malicious nature.

While the site is presently offline, defenders should continue to enforce DNS‑level blocking for Bitstarz.poker, monitor outbound connections to the IP 104.21.39.80, and update any web‑filter or sandbox signatures to include this indicator. Organizations should also educate users about the fraudulent use of “crypto casino” branding to lure victims, and ensure that any internal tools that query SSL/TLS certificates treat the lack of a certificate as a red flag. Ongoing vigilance is recommended to detect any re‑hosting of the same kit or reuse of the domain’s infrastructure in future campaigns.