m[.]tlcasino-mobilgiris[.]com

Analysis of m.tlcasino-mobilgiris.com shows that the domain was registered on 14 December 2025 through Gname.com Pte. Ltd. The registrar is a known provider that does not apply additional verification. The domain resolves to the IP address 198.18.2.24 and uses the nameservers a10.share-dns.com and b10.share-dns.net, both of which are commonly associated with shared hosting services. No TLS certificate is presented, meaning connections are unencrypted and vulnerable to interception. The site was classified as a crypto‑gambling scam, which aligns with the "tlcasino‑mobilgiris" naming pattern that mimics online casino services.

On public threat‑intel platforms the domain appears on a single security blocklist and has been flagged by three of ninety‑five VirusTotal scanners, indicating limited but non‑trivial detection. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed as blocked by PhishDestroy. As of the report date, the infrastructure has been taken offline, and no active HTTP response was observed. The lack of an SSL certificate and the low trust score suggest the site was not operating a legitimate service.

Defenders should continue to block the domain at perimeter filters, update DNS blacklists with the observed IP address 198.18.2.24, and monitor for any re‑hosting of the same payload or similar naming conventions. Because the domain is currently inactive, there is no immediate risk of credential harvesting, but the underlying hosting provider and nameserver configuration indicate a reusable platform for future campaigns. Continuous observation of the registrar Gname.com Pte. Ltd. and the associated nameservers is recommended to detect rapid re‑registration attempts. Organizations that previously deployed crypto‑gambling or casino‑related controls should verify that internal detection rules include the observed indicators of compromise, such as the domain string "tlcasino‑mobilgiris" and the IP 198.18.2.