casinorex-casino[.]com

This domain, casinorex-casino.com, is flagged as a credential theft operation impersonating the legitimate CasinoRex brand. Analysis indicates the site mimics official casino promotions, offering a fraudulent bonus of up to 1000€ and 100 free spins to deceive users into entering sensitive account credentials. The infrastructure is designed to harvest login details, financial information, or personal data under the guise of a trusted gambling platform, a common tactic in online fraud targeting high-value transaction environments. Infrastructure analysis reveals multiple high-risk technical indicators. The domain resolves to IP address 104.21.60.151 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an anomalous creation date suggesting potential domain spoofing or preemptive registration for malicious use. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and has been documented in eight threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. The domain is currently offline, likely due to enforcement actions such as takedown requests or hosting provider intervention. However, residual risk persists as threat actors may rehost the phishing kit on new infrastructure or reuse the domain in future campaigns. Users who interacted with the site should immediately reset credentials for any accounts entered, enable multi-factor authentication, and monitor financial statements for unauthorized transactions. Organizations should update blocklists with the domain and associated IP to prevent access from corporate networks.