bahiscasino-vipgiris[.]icu

This domain, bahiscasino-vipgiris.icu, is flagged as a credential theft phishing site targeting users of online gambling platforms. Analysis indicates the domain mimics legitimate casino brands to deceive victims into entering login credentials, payment details, or personal information. No specific drainer kit signatures were observed, but the infrastructure aligns with known phishing campaigns exploiting gambling-related themes to maximize engagement. Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3 and was registered on June 20, 2026, through Fewmoretaps OU d/b/a Trustname.com. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate. VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious. As of this report, the domain remains unlisted on Google Safe Browsing (GSB) and other major blocklists, limiting visibility for automated protections. The domain remains active and poses a high risk to users, particularly those searching for gambling-related services. Response actions should include immediate blacklisting by network security tools, DNS sinkholing, and endpoint protection updates. Users are advised to verify domain authenticity before entering credentials and to monitor financial accounts for unauthorized transactions. The low detection rate (1/95) underscores the need for manual review and proactive threat hunting to mitigate exposure.