# PhishDestroy threat dossier — catcasinos31w.run ================================================================ Fetched: 2026-07-16 09:53:23 UTC Canonical: https://phishdestroy.io/domain/catcasinos31w.run/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 93/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: SOCRadar, URLQuery URLQuery: 2 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 92.63.227.153 (PL, Gdansk) ASN: AS200088 Artnet Sp. z o.o. Hosting org: 3nt solutions LLP Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: pns1.cloudns.net, pns2.cloudns.net, pns3.cloudns.net, pns4.cloudns.net Registered: 2026-07-10 Expires: 2027-07-10 Page title: Cat Casino рабочее зеркало на сегодня, официальный сайт HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-10-09 Status: INVALID chain Fingerprint: 1de4f17234d3548fbd20254ae1f1626a5b716e5ab7e1a30bf33f2f2a9340f27f Subject Alternative Names (related infrastructure — often same operator): - www.catcasinos31w.run ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-10 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-13 23:16:29 UTC (by PhishDestroy tracker) First reported: 2026-07-14 11:56:03 UTC (abuse notice filed) Last verified: 2026-07-16 11:46:55 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f5d55-7d7c-705c-91e7-f9caa35c9fab/ URLQuery: https://urlquery.net/report/9cc8698c-a675-4f7e-9879-7d7d81fe3d79 Wayback Machine: https://web.archive.org/web/*/catcasinos31w.run crt.sh CT logs: https://crt.sh/?q=%25.catcasinos31w.run Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=catcasinos31w.run AlienVault OTX: https://otx.alienvault.com/indicator/domain/catcasinos31w.run URLhaus: https://urlhaus.abuse.ch/host/catcasinos31w.run/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-13 23:20:26 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Analysis indicates that catcasinos31w.run was registered on July 10 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The domain is hosted on Cloudns infrastructure, as evidenced by its four nameservers (pns1.cloudns.net through pns4.cloudns.net) and resolves to the IPv4 address 92.63.227.153. No public page content has been disclosed, and the site has not yet been examined by external scanning services, leaving the exact payload or credential‑harvesting mechanisms unknown. The combination of a recent registration, use of a reputable DNS provider, and alignment with the generic_phishing classification suggests the domain is being used to lure victims into providing login credentials or personal data, likely targeting users of online casino services given the lexical cue in the domain name. Defenders should treat the domain as malicious, add it to blocklists, monitor DNS queries for the associated IP address, and consider sinkholing or null‑routing traffic to mitigate potential abuse. Ongoing observation is advised to capture any changes in hosting or content that could refine the threat profile. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260714-3A3F6F Favicon MD5: 32312c5cd80ce73e26886f7066331d18 TLS cert SHA-256: 1de4f17234d3548fbd20254ae1f1626a5b716e5ab7e1a30bf33f2f2a9340f27f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/catcasinos31w.run/ JSON API: https://api.destroy.tools/v1/check?domain=catcasinos31w.run Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 179,272 domains (50,786 alive under monitoring, 128,486 confirmed takedowns/dead). Site: https://phishdestroy.io