candy96-australia[.]com

candy96-australia.com was registered on 28 April 2026 through Fewmoretaps OU d/b/a Trustname.com. The domain resolves to the Cloudflare edge address 104.21.60.166 and uses the nameservers marlowe.ns.cloudflare.com and sean.ns.cloudflare.com. TLS termination is provided by Google Trust Services (certificate WE1) and HTTP responses return status 200 with HSTS enabled. Front‑end analysis shows a stack comprising React, Next.js and Express on a Node.js runtime, while content is served via Strapi. The page title observed at the root URL is “Candy96 Casino | Top Real Money Online Casino 2026”, indicating a gambling‑oriented lure. Classified as a brand‑impersonation campaign, the site is linked to a known “Gambler Scam” phishing kit. The infrastructure received a Gridinsoft trust score of 0 / 100 and is listed on one public blocklist; PhishDestroy has already blocked the domain. No antivirus vendor detections are recorded, but the absence of detections does not confirm legitimacy. The current operational status is active and the risk level remains under investigation. Analysis indicates that the domain leverages a legitimate CDN to mask its origin, which complicates attribution. The use of a modern web framework suggests automated page generation, typical for large‑scale phishing deployments targeting casino players. Defenders should consider adding the domain to DNS‑based deny lists, monitor for outbound connections to the Cloudflare IP range, and inspect any credential submissions that may be directed to this host. Continuous observation of the domain’s TLS certificate, DNS records, and any changes to the underlying web application is recommended to detect potential escalation or repurposing.