gamdom-rewards[.]com

PhishDestroy identifies gamdom-rewards.com as an active Bitcoin brand impersonation domain deploying a crypto drainer kit to siphon user deposits under the guise of a reward program. The page mimics the legitimate Gamdom casino interface (Top Bitcoin & Crypto Casino!) and prompts victims to connect wallets or enter seed phrases, enabling direct fund theft. Traffic is redirected through Let’s Encrypt-validated SSL, adding a veneer of legitimacy to phishing lures distributed via social media, phishing emails, and malicious ads targeting crypto users.

Technical indicators confirm high risk: the domain scores 2/95 on VirusTotal with only two security vendors detecting the threat as of current scans. It resolves to IP 158.94.209.129 and was registered on May 06, 2026, through NameSilo, LLC—indicating a recently stood-up infrastructure likely leveraged before detection. While Google Safe Browsing (GSB) status and public blocklist counts were not provided, the absence of broad detection suggests a stealth campaign. The domain uses a deceptive naming pattern (gamdom-rewards.com) mimicking the legitimate gamdom.com to exploit user trust and bypass cognitive filters.

As of today, the domain remains active and continues to host the fraudulent Gamdom clone. Immediate response includes blocking the domain at DNS and network levels, flagging the IP 158.94.209.129 for all traffic, and updating browser blocklists and endpoint detections with the seed hash f116bc. End users are advised to access Gamdom only via verified bookmarks or official domain (gamdom.com), never through third-party links or ads. Given low detection rates and active hosting, the residual risk to uninformed crypto holders remains high, particularly in regions with high ad exposure and social media engagement.