gulcas[.]com

The domain gulcas.com was registered on August 30, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 172.67.193.243 (AS13335, United States). The site used the nameservers cartman.ns.cloudflare.com and jen.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS infrastructure. No SSL certificate was observed, and the site was taken offline at the time of analysis. The page title returned by the HTTP endpoint was "Gulcas: Most Popular Online Crypto Casino Based on Blockchain," aligning with the reported scam type of a crypto‑focused gambling scheme.

The campaign is associated with the Gambler Scam phishing kit, a known template used to lure victims into fraudulent cryptocurrency casino offers. Threat intelligence indicates the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded nine detections out of ninety‑five scanners, providing additional confirmation of malicious behavior. The Gridinsoft trust score of 0 out of 100 further reflects a high risk posture.

While the offline status suggests the site is no longer serving content, the infrastructure artifacts—Cloudflare hosting, lack of TLS, and the low trust score—remain relevant for correlation with other malicious actors using similar setups. Defenders should update URL filtering and domain reputation feeds to include gulcas.com, monitor for any re‑registration or reuse of the associated IP address, and enforce TLS validation policies to block non‑encrypted hosts. Continued observation of Cloudflare‑hosted IP ranges for similar scam kits is recommended to mitigate future impersonation attempts.