Analysis of sevencasino.info, created on July 26 2026, shows a recent registration by NICENIC INTERNATIONAL GROUP CO., LIMITED and deployment on Cloudflare’s DNS infrastructure (jerry.ns.cloudflare.com, norah.ns.cloudflare.com). The domain resolves to the IP address 172.67.180.254, which is part of Cloudflare’s edge network and does not reveal a dedicated backend host. It appears on a single security blocklist and has been actively blocked by the PhishDestroy feed, indicating that at least one threat‑intelligence source has classified the domain as malicious.
VirusTotal scanned the domain with 91 antivirus and URL‑reputation engines; none reported a detection, but the absence of alerts does not confirm safety, especially given the blocklist entry and the recent creation date. No public Safe Browsing, OTX, SSL certificate details, HTTP response codes, trust‑score metrics, or page‑title information are currently available, leaving those vectors unverified. The limited age of the domain, its association with a known phishing‑blocking list, and the lack of additional reconnaissance data suggest a high likelihood of phishing intent, consistent with the generic phishing label provided.
Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP and nameservers, and consider adding the domain to internal blacklists. Ongoing observation of threat‑intel feeds for any new detections or reputation changes is recommended, as well as periodic re‑scanning with expanded sandbox tools to capture any evolving payloads or malicious redirects.