mgmslots[.]co

Analysis of the domain mgmslots.co indicates a high-risk phishing campaign targeting online gambling users. Registered on July 11, 2026, through Tucows Domains Inc., the domain remains active as of July 22, 2026, resolving to the IP address 104.21.18.39. Infrastructure analysis reveals Cloudflare nameservers (garret.ns.cloudflare.com and oaklyn.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. Detection metrics show the domain is flagged by 6 of 95 security vendors on VirusTotal, a modest but notable signal given the domain's recent registration.

Additionally, it appears on one security blocklist, further supporting its classification as malicious. The domain's purpose aligns with generic phishing activity, though the exact content or targeted brand has not been confirmed through available evidence. No specific phishing kit, page title, or brand impersonation details were provided, limiting further attribution. Defenders should note the short lifespan of the domain—11 days at the time of this report—which is consistent with phishing campaigns designed to operate briefly before detection or takedown.

The use of Cloudflare nameservers may complicate IP-based blocking, though the resolved IP (104.21.18.39) can be monitored for additional malicious domains. Organizations are advised to block the domain at the DNS or proxy level and monitor associated infrastructure for related threats. Given the domain's recent registration and active status, continued vigilance is recommended, particularly for sectors frequently targeted by credential-harvesting campaigns, such as online gaming and financial services. No evidence currently suggests widespread adoption by threat actors, but the domain's detection profile warrants inclusion in threat intelligence feeds.