musplays[.]com

Analysis of musplays.com shows a confirmed crypto‑casino phishing page that was taken offline prior to the reporting date of July 23 2026. The site presented the page title “Musplays: Most Popular Online Crypto Casino Based on Blockchain,” indicating a targeted crypto gambling lure. The domain was registered on September 29 2025 through Web Commerce Communications Limited and is hosted on Cloudflare’s network (AS13335) at IP 104.21.29.182, a U.S. location. No SSL certificate is configured, and the HTTP service was observed as inactive, consistent with the “taken offline” status.

The underlying malicious infrastructure employs the Gambler Scam phishing kit, a known template for crypto‑draining operations. Reputation scoring is extremely low, with a Gridinsoft trust rating of 1 out of 100, and the domain appears on a single security blocklist. Independent threat intel confirms inclusion in one AlienVault OTX pulse and a block by the PhishDestroy service. VirusTotal scans flagged the domain in 12 of 93 vendors, reinforcing the malicious assessment.

While the page content has not been inspected directly, the combination of the deceptive page title, kit attribution, low trust score, and multiple detections provides strong evidence of a crypto‑scam phishing campaign. Defenders should continue to block the domain at network perimeters, update intrusion‑prevention signatures to include the listed IP and nameservers (anahi.ns.cloudflare.com, grant.ns.cloudflare.com), and monitor for any re‑hosting attempts. Given the absence of SSL and the offline status, the threat surface is currently limited, but the infrastructure may be repurposed for future campaigns; therefore, ongoing vigilance is advised.