22casino[.]co[.]com

The domain 22casino.co.com is actively hosting a fraudulent site that impersonates the Mastercard brand in a crypto gambling scheme. The site resolves to the IPv4 address 38.180.53.243, which is registered to AS9009 M247 Europe SRL and geolocated to Spain. Hosting runs on an Ubuntu server with Nginx front‑end, while the application stack includes WordPress, MySQL, and PHP, indicating a typical content‑management system repurposed for malicious use. The SSL certificate is issued by Let’s Encrypt (R12), providing valid HTTPS with a standard trust chain, which may reduce suspicion from casual users. The page title returned by the HTTP 200 response reads "22Casino | Accede a la Web Oficial de 22Casinos en España," confirming the site claims to be a Spanish casino portal.

Registration details show the domain was created on August 16, 1997 and is managed through Moniker Online Services LLC, using the four NIC.co.com nameservers. The domain has a Gridinsoft trust score of 0/100, reflecting a severe lack of credibility. Security telemetry indicates the domain is listed on four blocklists and has been blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis shows three of ninety‑one scanners flag the domain, reinforcing the malicious classification.

The observed phishing kit aligns with known gambler‑scam templates, which commonly lure victims into depositing cryptocurrency under the pretense of casino winnings. While the exact content of the landing page has not been examined, the combination of brand impersonation, a gambling lure, and the presence of a known scam kit suggests a high‑risk operation. Defenders should add 38.180.53.243 and 22casino.co.com to outbound and inbound filtering rules, monitor for Mastercard‑related credential or payment attempts, and ensure that URL filtering solutions block the domain across all user agents.