brcsn300[.]net

brcsn300.net was registered on April 24, 2026 and is currently marked as active with a high risk rating. The site presents a Russian‑language casino landing page titled “BroCas - онлайн казино, где всё по-честному | Забирай свой бонус!” which aligns with the generic_phishing classification. The domain resolves to the Cloudflare address 172.67.201.26, an IP located in Canada and associated with Cloudflare, Inc. HTTP requests receive a 302 redirect, and the TLS certificate is issued by Google Trust Services under the WE1 descriptor, indicating use of a legitimate certificate authority to increase credibility.

The registration record lists Fewmoretaps OU doing business as Trustname.com as the registrant, a detail that matches other recent malicious registrations observed in the region. The use of Cloudflare’s CDN and a valid Google‑signed certificate suggests an attempt to hide the true origin of the payload while leveraging trusted infrastructure to evade naïve inspection.

Threat intelligence sources have begun to surface. The domain appears on a single security blocklist and is flagged by PhishDestroy. AlienVault OTX has cited the domain in eight separate pulses, and Gridinsoft assigns it a trust score of 0 out of 100. VirusTotal reports two of ninety‑five scanning engines flagging the domain, reinforcing the suspicion despite the low overall detection count.

Analysis indicates that the primary malicious objective is credential harvesting for casino‑related accounts, though the exact phishing kit or payload has not been publicly released. Defenders should block DNS resolution to 172.67.201.26 for any internal users, enforce URL filtering for the domain, and monitor for HTTP 302 responses that redirect to the same host. Continuous monitoring of the domain’s reputation on additional blocklists and periodic re‑scanning with multi‑engine services are recommended to capture any escalation in detection rates.