realprize[.]at

The domain realprize.at was observed delivering a crypto‑casino phishing campaign that masquerades as a popular online gambling service. The page title returned by the server was "Realprize: Most Popular Online Crypto Casino Based on Blockchain", indicating an attempt to attract cryptocurrency users. Infrastructure analysis shows the domain is registered through Cloudflare, Inc., using the nameservers dave.ns.cloudflare.com and nena.ns.cloudflare.com. DNS resolution points to the IP address 172.67.201.163, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

No TLS certificate was presented; the site operated without HTTPS, which is atypical for a service claiming to handle financial transactions and further undermines its legitimacy. The site’s trust score from Gridinsoft is 1 out of 100, reflecting extreme suspicion. Malware and URL scanners on VirusTotal flagged the domain in 13 of 93 security vendor checks, confirming the presence of malicious indicators. The campaign is associated with a known "Gambler Scam" phishing kit, a template frequently reused to harvest credentials and redirect victims to fraudulent crypto‑wallets.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy sinkhole, indicating that at least one defensive platform has taken active mitigation steps. Current monitoring shows the site is offline, but the underlying infrastructure – Cloudflare‑proxied IP address and low‑trust score – suggests the operators could reactivate the domain quickly or clone the content to a new host. Defenders should continue to block the domain at perimeter firewalls and DNS filters, monitor related IP address 172.67.201.163 for any new hostnames, and enforce TLS inspection policies to detect similar unencrypted phishing sites.