ruoram[.]com

The domain ruoram.com was registered on 16 October 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.145.35, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The site’s public page title reads “Ruoram: Most Popular Online Crypto Casino Based on Blockchain”, indicating a cryptocurrency‑focused gambling front. Analysis of the hosting infrastructure shows the domain is served via Cloudflare’s edge network and uses the nameservers carter.ns.cloudflare.com and dayana.ns.cloudflare.com. No TLS certificate was presented at the time of observation, and the service was reported as taken offline by the PhishDestroy blocklist. The site has been identified as employing the “Gambler Scam” phishing kit and is classified as a Crypto Scam.

Reputation scoring from Gridinsoft assigns a trust score of 1 out of 100, reflecting extremely low confidence in legitimacy. VirusTotal scans recorded 7 detections out of 95 security vendors, confirming malicious activity, and the domain appears on at least one external security blocklist. The lack of an active SSL certificate, combined with the low trust score and multiple vendor detections, suggests the domain was used to lure victims into a fake online crypto casino, likely to harvest credentials or cryptocurrency payments. Uncertainty remains regarding the current operational status of the site; the last known state is offline, and no live HTTP response was captured.

Additionally, the exact payload delivered by the Gambler Scam kit has not been publicly released, so the precise data‑theft mechanisms cannot be confirmed. Defenders should continue to block ruoram.com at network boundaries, update DNS‑based blocklists with the observed nameservers and IP address, and monitor for any re‑hosting attempts that might use the same Cloudflare edge IPs. Incident response teams should also inspect logs for connections to 172.67.145.