zefocas[.]com

Analysis of the domain zefocas.com indicates it was actively involved in a crypto-based phishing campaign, classified under the Gambler Scam phishing kit. Registered on October 3, 2025, through INWX GmbH, the domain resolved to the IP address 104.21.3.130, hosted on Cloudflare's infrastructure (AS13335) in the United States. The domain's nameservers, cash.ns.cloudflare.com and mallory.ns.cloudflare.com, further confirm its association with Cloudflare's network. No SSL certificate was detected at the time of assessment, increasing the risk of unencrypted data transmission. The page title, 'Zefocas: Most Popular Online Crypto Casino Based on Blockchain,' explicitly identifies the domain's purported function as a cryptocurrency gambling platform, aligning with the reported scam type.

Detection data reveals that zefocas.com appeared on one security blocklist and was flagged by 9 of 93 security vendors on VirusTotal, indicating elevated suspicion. The domain was also blocked by PhishDestroy prior to being taken offline. Gridinsoft assigned a trust score of 1 out of 100, reflecting a high level of distrust in its legitimacy. Defenders should treat this domain as compromised infrastructure.

While the domain is currently offline, its prior association with a known phishing kit and cryptocurrency scam warrants continued monitoring. Network security teams are advised to review logs for connections to 104.21.3.130 and the domain itself, particularly in environments where cryptocurrency-related activity is prohibited or closely regulated. The absence of an SSL certificate and the use of Cloudflare's services are consistent with phishing campaigns that seek to obscure origin and evade detection. No further details about the exact content or targeting of the phishing pages are available at this time.