dragoniacasino-aus[.]com

The domain dragoniacasino-aus.com has been identified as a credential theft operation targeting users through deceptive login portals. Analysis confirms its current status as offline, though prior activity indicates an active campaign to harvest usernames, passwords, and session tokens. No direct brand impersonation has been confirmed, but the domain mimics legitimate online casino platforms to exploit user trust and bypass initial suspicion. Infrastructure analysis reveals the domain was registered on March 17, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 104.21.95.185, a shared hosting environment commonly abused for malicious operations. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not validate legitimacy. Detection metrics show the domain was flagged by 2 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. It appears on one security blocklist and was previously blocked by PhishDestroy. AlienVault OTX records the domain in a single threat intelligence pulse, suggesting limited but confirmed malicious activity. Current status indicates the domain is offline, reducing immediate risk of user exposure. However, historical data and infrastructure reuse patterns suggest potential reactivation. Organizations and individuals are advised to block the domain and its associated IP (104.21.95.185) at the network perimeter. Endpoint protection should be configured to detect and prevent access to newly registered domains with similar naming conventions (e.g., regional casino-themed domains). Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Monitoring for related domains registered through Fewmoretaps OU or resolving to the same IP range is recommended to mitigate future threats.