casinreg[.]live

On July 23, 2026 analysts observed that the domain casinreg.live resolves to the Cloudflare‑owned address 172.67.131.20, ASN 13335, hosted in the United States. The domain is registered through Cloudflare, Inc., and uses the authoritative nameservers athena.ns.cloudflare.com and cesar.ns.cloudflare.com. No TLS certificate is presented, meaning the site served traffic over plain HTTP despite advertising a “Most Popular Online Crypto Casino Based on Blockchain” in its page title. The site was flagged by 14 of 95 VirusTotal scanners, each labeling it as malicious, and it appears on a single external blocklist.

Gridinsoft assigned a trust score of 0 / 100, confirming the low reputation. The underlying malicious infrastructure matches the publicly known “Gambler Scam” phishing kit, which is commonly employed to lure cryptocurrency users into credential‑stealing or fund‑transfer schemes. The domain has been taken offline at the time of reporting, and PhishDestroy records indicate it was previously blocked. While the exact content of the page was not captured, the title and kit attribution suggest a crypto‑focused gambling lure.

Defenders should immediately block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of the IP or similar Cloudflare‑hosted addresses, and add the domain to internal threat‑intel feeds. Continuous monitoring of Cloudflare‑hosted IP ranges for other deployments of the Gambler Scam kit is advised, as threat actors frequently recycle such infrastructure. Indicators of compromise include the domain name, the IP 172.67.131.20, the two Cloudflare nameservers, and the lack of TLS. Researchers should also query VirusTotal for the latest scan results and update detection signatures accordingly.