gazcas[.]com

Analysis of gazcas.com, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on 5 June 2026, shows a newly created domain that has been associated with a brand‑impersonation phishing campaign using the Gambler Scam kit. The domain resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Cloudflare services are confirmed by the presence of Cloudflare DNS (apollo.ns.cloudflare.com, sierra.ns.cloudflare.com) and by detection of Cloudflare Browser Insights, Twitter Ads and a Facebook Pixel on the site. An SSL certificate issued by Google Trust Services under the WE1 hierarchy secures the site.

HTTP responses return the non‑standard code 666, a tactic often employed to evade conventional monitoring. VirusTotal records indicate that 13 of 91 scanning engines have flagged the domain, and the domain appears on a single security blocklist, currently enforced by PhishDestroy, which has taken the site offline. The Gridinsoft trust score of 0 / 100 further reflects a high‑risk assessment.

The page title returned by the server is simply “gazcas.com”, and no additional content has been captured, leaving the exact visual lures or credential‑capture mechanisms unverified. Given the combination of a recent registration, low trust scores, malicious kit attribution, and active blocklisting, defenders should add gazcas.com to DNS and URL filtering lists, monitor Cloudflare‑origin IP ranges for similar rapid‑creation domains, and enforce strict outbound controls on traffic to newly registered domains that exhibit similar technology stacks. Continuous re‑evaluation is advised in case the site is re‑hosted or the phishing kit is updated.