w78-top[.]com

This domain is flagged as an elevated-risk phishing site specializing in online casino fraud. Analysis indicates it operates under the generic_phishing threat category, designed to deceive users into disclosing credentials or financial information under the pretense of secure gambling platforms. The page title, "w78 - Aposte com Segurança e Ganhe Bônus em Cassinos Online," explicitly promotes fraudulent bonus schemes, a common tactic in financial phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on August 15, 2025, through July Name Limited and resolves to IP address 104.21.93.210. Security vendors on VirusTotal flagged it in 13 out of 95 scans, while it appears on 2 security blocklists. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently exploited by malicious actors to lend false credibility. Additional intelligence sources include a single threat pulse on AlienVault OTX and blocking by two anti-phishing platforms. Gridinsoft assigns it a trust score of 0/100, reinforcing its high-risk classification. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (104.21.93.210) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) in endpoint detection and response (EDR) systems, focusing on phishing-specific behavioral rules. User awareness training should emphasize the risks of online gambling platforms, particularly those promising unrealistic bonuses. Additionally, domain reputation checks should be conducted for any newly registered domains from the same registrar (July Name Limited) to preemptively identify similar threats. Monitoring for credential theft attempts originating from this domain is advised, as phishing victims may experience follow-on attacks.