gam-ma-cks1no[.]com

Analysis of gam-ma-cks1no.com shows a newly registered domain created on 21 August 2025 that resolves to the IPv4 address 185.196.8.2 located in Switzerland under ASN 42624 (Global-Data System IT Corporation). The domain is hosted on Cloudflare name servers fish.ns.cloudflare.com and hasslo.ns.cloudflare.com, lacks an SSL certificate, and currently returns no HTTP response as it has been taken offline. The page title observed during the brief crawl was “Gama Casino,” indicating an attempt to impersonate an online gambling service. Intelligence links the site to a crypto gambling phishing campaign and identifies the used toolkit as the “Gambler Scam” kit, consistent with the observed branding.

VirusTotal scans reported three detections out of ninety‑five antivirus engines, and the domain is listed on a single public blocklist and flagged by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Registration was performed through Web Commerce Communications Limited, a registrar frequently associated with abusive registrations.

While the site is currently offline, the infrastructure—particularly the Cloudflare DNS and Swiss IP hosting—may be reused for future campaigns. Defenders should block the domain and its resolving IP, monitor for re‑registration, and add the associated name servers to deny‑list rules. Additional scrutiny of traffic to the IP range 185.196.8.0/24 is advised, as well as continued observation of any new domains created by the same registrar that reference gambling or cryptocurrency themes.