minicasino[.]lol

Analysis of minicasino.lol, a domain created on February 26, 2026, indicates that it was actively serving a crypto‑focused phishing operation before being taken offline. The site advertised itself with the page title "Minicasino: Most Popular Online Crypto Casino Based on Blockchain," aligning with the classified scam type of a Crypto Scam. Infrastructure inspection shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. Both authoritative nameservers are hosted by Cloudflare (henry.ns.cloudflare.com and zelda.ns.cloudflare.com).

No SSL certificate was observed, and the HTTP service is no longer reachable as of the July 25, 2026 report date. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy, confirming that defensive feeds have already flagged it. VirusTotal scans returned 11 detections out of 93 vendors, reinforcing the malicious assessment. Independent reputation scoring from Gridinsoft assigns a trust score of 1 out of 100, reflecting extreme risk.

Registration was performed through Atak Domain, a registrar frequently associated with short‑lived malicious sites. The phishing kit identified is the Gambler Scam package, which is commonly used to impersonate online gambling or casino services to lure victims into transferring cryptocurrency. Given the combination of a low trust score, multiple vendor detections, and blocklist entries, defenders should ensure the domain is denied at network perimeter controls, add the associated IP address 188.114.97.3 to blacklists, and monitor for any re‑registration attempts or similar domains using the same nameserver pattern. Continuous telemetry collection on related Cloudflare‑hosted assets is advised, as the underlying infrastructure may be reused for future campaigns.