casino-jeton-rouge[.]com

PhishDestroy identifies casino-jeton-rouge.com as an active credential-harvesting phishing domain currently under investigation for mimicking a legitimate gaming site to steal login credentials. The domain is in the early stages of its campaign lifecycle and has not yet been widely blocked or flagged by security vendors, making it particularly dangerous to unaware users. Detection ratios remain critically low, with VirusTotal showing 0 detections out of 95 engines as of the latest scan, indicating a recent or well-disguised threat still evading broad detection. This domain was flagged by PhishDestroy’s seed 445a2b and exhibits multiple technical indicators of compromise. It resolves to IP 188.114.96.3 with an SSL certificate issued by Let’s Encrypt, suggesting an attempt to appear legitimate through HTTPS encryption. The domain was registered on March 17, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar with a history of inadequate abuse controls. Notably, the domain remains undetected by antivirus and threat intelligence platforms, with no matches in public threat feeds or blocklists. The lack of detections, combined with recent registration and active hosting on a shared IP, suggests a live and evolving threat with high potential for credential theft. Users are strongly advised to avoid accessing casino-jeton-rouge.com and to report any encounter to their security teams immediately. Organizations should block the domain and IP at the network perimeter and DNS level to prevent lateral exposure. Credential rotation is recommended for any users who may have entered login details on the site, as this domain is specifically designed to harvest authentication data. Monitor for follow-on attacks leveraging the stolen credentials, as compromised accounts are often used in secondary phishing or account takeover campaigns. This domain should be treated as a high-risk threat until detection ratios improve and definitive blocklists are published.