mafia-casino-fr1[.]com

mafia-casino-fr1.com is an active generic_phishing site observed on 12 July 2026. The site returns HTTP 200 and displays the title “Mafia Casino – Jeux enligne & Bonus 150% jusqu’à 500 €”, clearly targeting French‑speaking gambling customers with a deceptive bonus offer. The page is built with the publicly available Gambler Scam kit, which is known to replicate legitimate online casino login forms to harvest credentials.
Technical analysis shows the domain resolves to 104.21.28.204, an address owned by Cloudflare, Inc. in Canada. The domain uses a Let’s Encrypt certificate (E7) and is served from two Cloudflare authoritative name servers: magnolia.ns.cloudflare.com and marek.ns.cloudflare.com. The domain was registered on 24 April 2026 through Fewmoretaps OU d/b/a Trustname.com. No additional infrastructure beyond the Cloudflare front‑end has been identified.
The site is currently listed on a single security blocklist and was flagged by PhishDestroy. VirusTotal scans indicate that 1 out of 95 security vendors flagged the domain, and AlienVault OTX reports a single pulse referencing the same indicator. Gridinsoft assigns a trust score of 0/100, suggesting a high confidence of malicious intent. The combination of a fresh registration, use of a known gambling phishing kit, and rapid appearance on blocklists aligns with a high‑risk phishing campaign.
Defenders should block both the domain and its resolving IP at perimeter firewalls and DNS filtering solutions. Email gateways should be updated to detect the “Mafia Casino” brand in subject lines and body content, and user awareness training should emphasize the illegitimate 150 % bonus claim. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, as the attacker can shift hosting behind the same CDN without changing the domain name.