r7-casino231[.]online

Analysis as of July 29, 2026 identifies r7-casino231.online as an active generic phishing infrastructure with an elevated risk rating. The domain was registered on May 30, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is delegated to Cloudflare nameservers agustin.ns.cloudflare.com and monroe.ns.cloudflare.com, indicating use of Cloudflare’s DNS and DDoS mitigation services. DNS resolution points to the IP address 104.21.43.207, which belongs to Cloudflare’s edge network, a common hosting choice for malicious operators seeking anonymity and rapid content changes.

VirusTotal scans have recorded five positive detections out of ninety‑one submitted security vendors, confirming that multiple anti‑malware engines have observed malicious characteristics associated with the domain. The domain is currently listed on one public security blocklist and has been explicitly blocked by the PhishDestroy filtering service, providing additional evidence of its use in phishing campaigns. No publicly available information on SSL certificate details, HTTP response codes, or page title has been released, leaving those vectors unverified.

The lack of disclosed page content prevents confirmation of the exact phishing lure or targeted brand, though the generic classification aligns with the observed infrastructure. Defenders are advised to add the domain and its resolving IP to blocklists at network perimeter, incorporate the indicator into email gateway and web filtering rules, and monitor for any emergence of related sub‑domains or additional Cloudflare‑hosted assets. Continuous re‑scanning with VirusTotal and regular checks against emerging blocklists will help maintain coverage as the threat evolves.