ggrac[.]com

Analysis of ggrac.com, observed as a malicious infrastructure supporting a crypto‑casino phishing campaign, indicates the domain was registered on 13 October 2025 through Dominet (HK) Limited. The domain resolves to 104.21.60.62, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The site was hosted behind Cloudflare’s network and presented no TLS certificate, which is consistent with the current offline status. The page title returned by the server – “Ggrac: Most Popular Online Crypto Casino Based on Blockchain” – aligns with the classified scam type of a crypto‑scam and the use of a Gambler Scam phishing kit. Threat intelligence sources confirm that 10 of 95 VirusTotal scanners have flagged the domain, Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX lists the domain in a single pulse.

PhishDestroy has added ggrac.com to its blocklist, and the domain appears on at least one additional security blocklist. The nameservers observed (art.ns.cloudflare.com, bingo.ns.cloudflare.com, boyd.ns.cloudflare.com, desiree.ns.) are typical of Cloudflare‑hosted domains and do not provide further attribution. Uncertainty remains regarding the exact content served before takedown, as no SSL certificate was present and the site is currently offline. No additional indicators such as payload hashes, phishing URLs, or victim reports have been published. Consequently, the full scope of the campaign – including potential affiliate domains or reused phishing kits – cannot be fully enumerated at this time.

Defenders should immediately block DNS resolution for ggrac.com and any sub‑domains, add the associated Cloudflare IP (104.21.60.62) to network‑level deny lists, and incorporate the domain into URL filtering policies. Monitoring of other Cloudflare‑hosted assets that share the same registrar or nameserver pattern is advised, as threat actors frequently rotate domains within the same hosting environment.