richard-casino2[.]com

The domain richard-casino2.com was registered on 28 April 2026 through Fewmoretaps OU d/b/a Trustname.com. It is currently resolved to the Cloudflare‑hosted address 188.114.96.3, which maps to a Cloudflare data center in Canada. The site presents a valid Let's Encrypt certificate (issued by E7) but returns HTTP 403 for direct requests, indicating that the landing page is likely protected by access controls or conditional delivery.

VirusTotal scans have flagged the domain in six out of ninety‑five security vendors, and AlienVault OTX lists it in a single threat pulse. The domain appears on one external blocklist and has been actively blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Nameserver configuration uses dilbert.ns.cloudflare.com and jean.ns.cloudflare.com, both standard Cloudflare resolvers, which obscures the true hosting environment.

The limited public response (HTTP 403) prevents direct observation of the phishing payload, so the exact content and targeted brand remain unknown. However, the combination of a recent registration date, low trust score, presence on multiple blocklists, and the classification as a generic phishing campaign suggest a high‑confidence malicious intent. The use of Cloudflare’s CDN and a free TLS certificate is consistent with typical phishing infrastructure designed to lend legitimacy while hiding origin.

Defenders should add richard-casino2.com to DNS and web‑filter deny lists, enforce network‑level blocking of the resolved IP 188.114.96.3, and monitor for any C2 traffic that may arise from compromised browsers. Continuous re‑query of the domain’s DNS records is advised, as Cloudflare may shift the underlying IP address. Integrating the domain into threat‑intelligence feeds and correlating any user‑initiated connections with this indicator will help contain potential credential harvesting attempts.