sevencasino[.]ltd

This domain, sevencasino.ltd, is flagged as a high-risk credential theft operation targeting users through brand impersonation of a UK-based online casino. Analysis indicates the site presents a fabricated £7,500 welcome bonus offer to deceive visitors into submitting personal and financial details, which are then harvested for fraudulent transactions or account takeovers. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting campaigns commonly deployed in gambling-related scams. Infrastructure analysis reveals the domain was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. The domain resolves to IP address 172.67.158.20, hosted by Cloudflare in Canada, a common proxy service used to obscure malicious infrastructure. Security vendor detection on VirusTotal stands at 2/95, with one active blocklist entry. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy while the domain remains unlisted in Google Safe Browsing databases. As of the latest assessment, sevencasino.ltd remains active and continues to serve fraudulent content. Users encountering this domain are advised to avoid interaction, as any submitted credentials are likely to be exfiltrated to attacker-controlled servers. Organizations should implement DNS-based blocking for the domain and IP, while individuals should verify gambling offers only through official, verified channels. The remaining risk is classified as high due to the domain's operational status, lack of widespread detection, and the financial incentive for attackers to maintain the campaign.