mellstroy136[.]casino

Analysis of mellstroy136.casino, observed on July 22, 2026, indicates that the site was actively serving a crypto‑gambling phishing campaign before being taken offline. The domain resolves to the IPv4 address 179.43.157.7, which belongs to Autonomous System 51852 (Private Layer INC) and is geolocated to Switzerland (CH). The hosting infrastructure is reflected in the registrar‑provided name server set ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. No TLS certificate was presented during connection attempts, confirming the absence of HTTPS protection.

The page title returned by the HTTP response reads "Меллстрой казино официальный сайт | Mellstroy casino Регистрация и вход, игровые автоматы, актуальное зеркало!", matching the known phishing kit identified as “Gambler Scam” and confirming the targeting of a Russian‑language gambling brand. The site was flagged by three of ninety‑five VirusTotal scanners, and it appears on a single external security blocklist. PhishDestroy has already blocked the domain, and the Gridinsoft trust score of 0 / 100 reflects a highly malicious reputation.

Current status is offline, but the IP address and name server range remain reusable for future campaigns. Defenders should continue to block the domain and its resolving IP at network perimeter controls, add the host to internal threat‑intel feeds, and monitor the ASN 51852 for similar malicious registrations. Given the lack of SSL and the low trust score, any attempted connections to this infrastructure should be rejected, and users should be warned against providing credentials or cryptocurrency payments to sites matching the observed page title or kit pattern.