woori[.]casino

This domain, woori.casino, is flagged for high-risk brand impersonation targeting the online gambling and cryptocurrency casino sector. Analysis indicates the site mimics a legitimate crypto casino platform, presenting itself under the title 'Woori: Most Popular Online Crypto Casino Based on Blockchain.' The domain remains active and accessible as of the latest verification, posing a continued threat to users seeking blockchain-based gambling services. Infrastructure analysis reveals the domain was registered on April 16, 2026, through NameSilo, LLC, a registrar frequently associated with suspicious or newly established domains. It resolves to the IP address 104.21.57.79, which is part of a network range commonly used for content delivery and proxy services, potentially obscuring the true origin of the malicious infrastructure. VirusTotal detection metrics show that 2 of 95 security vendors have flagged woori.casino as malicious or phishing-related, a low but notable detection rate that may indicate evasion techniques or recent deployment. The domain employs a Let's Encrypt SSL certificate, providing encrypted connections that may lend a false sense of legitimacy to unsuspecting visitors. Current status confirms the domain remains operational, with no evidence of takedown or remediation efforts. Users and organizations are advised to block access to woori.casino at the network level and update endpoint protection rules to include this domain and its associated IP. Security teams should monitor for related infrastructure, such as newly registered domains under the same registrar or resolving to the same IP range. Financial institutions and cryptocurrency platforms are urged to warn customers about this impersonation campaign, particularly those targeting users of blockchain-based gambling services.