grokcas[.]com

grokcas.com was observed hosting a fraudulent cryptocurrency casino front that claims to be the “Most Popular Online Crypto Casino Based on Blockchain.” The site was registered on 17 November 2025 through MAT BAO CORPORATION and uses Cloudflare nameservers cheryl.ns.cloudflare.com and jihoon.ns.cloudflare.com. DNS resolution points to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP. The page title retrieved from the live host matches the advertised claim and aligns with the “Gambler Scam” phishing kit identified in the intelligence feed.

Static analysis shows that 15 of 93 VirusTotal scanners flag the domain as malicious, and the site is listed on a single security blocklist. The Gridinsoft trust score of 1/100 further confirms a highly suspicious reputation. PhishDestroy has already taken the domain offline, and current status is reported as taken offline. The domain appears on one external blocklist, but no additional threat‑intel sources (OTX, Safe Browsing) are referenced in the provided data.

Given the combination of a newly created domain, lack of encryption, low trust score, and detection by multiple AV engines, the infrastructure is consistent with a crypto‑focused phishing operation that aims to lure victims into depositing cryptocurrency under the pretense of a legitimate casino. Defenders should block DNS resolution for grokcas.com, add the IP address 188.114.97.3 to network‑level deny lists, and ensure that any outbound traffic to this host is denied. Monitoring for similar domains that use the same registrar, nameservers, or the “Gambler Scam” kit is recommended. Because the site is already offline, incident response can focus on gathering any residual artifacts from endpoint logs and confirming that no successful credential or fund transfers have occurred.