lizarocasinofr[.]net

The domain lizarocasinofr.net was registered on 22 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare edge address 104.21.28.55, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The site presented the page title “Lizaro Casino France | Connexion avec bonus 3000€””, indicating a focus on French‑language casino promotions and a advertised €3,000 bonus. Technical fingerprinting identified the static site generator Hugo, Cloudflare front‑end services, and HTTP/3 support, all typical of low‑cost phishing deployments. The TLS certificate is issued by Google Trust Services under the “WE1” designation, confirming that the connection was terminated at Cloudflare’s CDN rather than a self‑signed or compromised certificate.

VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain, and the domain appears on a single external security blocklist. Independent phishing‑tracking service PhishDestroy has also listed the domain as blocked. The Gridinsoft trust score of 0 / 100 further reflects a high likelihood of malicious intent. The infrastructure is associated with the publicly known “Gambler Scam” phishing kit, which is commonly used to harvest credentials for crypto‑based gambling platforms.

As of the report date the domain is offline, preventing active probing, but the underlying IP address remains under Cloudflare control and could be reused for future campaigns. Defenders should continue to block the IP 104.21.28.55 at the network perimeter, add lizarocasinofr.net to URL filtering policies, and monitor the registrar NiceNIC for any rapid re‑registrations. Continuous re‑scanning with multi‑engine services is advised to capture any changes in payload or hosting. The combination of a recent registration date, low trust score, targeted page title, and association with a known gambling phishing kit justifies an elevated risk rating and warrants proactive mitigation.