wemcas[.]com

Analysis of wemcas.com, registered on 7 October 2025 through MAT BAO CORPORATION, shows the site was used for a crypto‑casino phishing campaign. The page title advertised "Wemcas: Most Popular Online Crypto Casino Based on Blockchain," indicating a fake gambling service designed to lure cryptocurrency users. The domain resolves to the IPv6 address 2606:4700:3030::6815:2ebe, which is hosted by Cloudflare (AS13335) in the United States. No TLS certificate is presented, meaning the site was served over plain HTTP before being taken offline.

Detection services on VirusTotal reported 12 of 95 scanners flagging the domain as malicious, and Gridinsoft assigned a trust score of 0 / 100. The infrastructure is listed on a single security blocklist and has been blocked by the PhishDestroy service. Nameserver records point to grannbo.ns.cloudflare.com and michael.ns.cloudflare.com, confirming Cloudflare DNS usage. The campaign appears to employ the publicly available "Gambler Scam" phishing kit, consistent with the crypto‑scam classification.

At the time of this report the site is offline, so live content cannot be inspected, and no SSL/TLS fingerprint is available for further certificate analysis. Defenders should continue to block the domain, monitor the associated IPv6 address for any re‑hosting activity, and add the domain to internal URL filtering and threat‑intel feeds. Additional investigation should focus on any phishing emails that reference wemcas.com to correlate victim interaction vectors and to identify potential credential harvesting endpoints. Until the site reappears, the observable indicators remain limited to registration data, hosting details, detection counts, and the known kit fingerprint.