imperialclub[.]cc

The domain imperialclub.cc was observed hosting a crypto‑focused phishing page that advertises an online casino built on blockchain technology. The page title returned by the HTTP response is “Imperialclub: Most Popular Online Crypto Casino Based on Blockchain”, confirming the claimed theme. The site resolves to the IP address 172.67.221.236, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. Nameserver records point to desiree.ns.cloudflare.com and nikon.ns.cloudflare.com, both Cloudflare‑operated, indicating the use of Cloudflare’s DNS and CDN services. The domain was registered on 21 November 2025 through NameCheap, Inc., and no SSL certificate was presented at the time of analysis, leaving the connection unencrypted.

VirusTotal scanned the domain and recorded detections from 15 of 95 security vendors, suggesting that a significant minority of scanners classify the host as malicious. Additional reputation services have flagged the domain: PhishDestroy lists it as blocked, Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single external security blocklist. AlienVault OTX references the domain in two separate threat‑intel pulses, further corroborating its association with malicious campaigns. The identified phishing kit is labeled “Gambler Scam”, and the overall scam type is recorded as a “Crypto Scam”, aligning with the promotional language in the page title.

The service is currently marked as offline, which may indicate that the phishing infrastructure has been taken down or is temporarily unavailable. However, the underlying infrastructure—Cloudflare hosting, a recently created domain, and the absence of TLS—remains exploitable for future campaigns. Defenders should add imperialclub.cc to blocklists at the DNS and proxy layers, monitor traffic to the associated IP 172.67.221.