riverclub-24[.]com

Analysis of riverclub-24.com indicates a high-risk phishing domain targeting users with an online gambling theme. The domain was registered on November 11, 2025, through Dynadot LLC and currently resolves to IP address 172.67.178.251. The page title, 'RIVERCLUB24 : เว็บไซต์พนันออนไลน์ครบวงจร มาตรฐานระดับสากล,' explicitly identifies it as an online gambling platform, which aligns with known phishing patterns for credential harvesting or financial fraud. Infrastructure review reveals the use of WordPress, MySQL, PHP, and Cloudflare, alongside Yoast SEO and Hostinger hosting. The SSL certificate is issued by Google Trust Services, which does not inherently validate legitimacy. The domain appears on two security blocklists and is flagged by 7 of 95 security vendors on VirusTotal. AlienVault OTX records show it in 24 threat intelligence pulses, reinforcing its malicious classification. Active blocking by PhishDestroy and BLP-Malware further confirms its high-risk status. Defenders should treat this domain as confirmed malicious. Immediate actions include blocking the domain and its resolving IP at the perimeter, reviewing logs for internal connections, and alerting users to the phishing threat. The domain remains active as of July 12, 2026, with no evidence of takedown or mitigation. Given the gambling theme and regional language targeting, prioritize monitoring for credential theft or financial fraud attempts linked to this infrastructure.