1win-official-argentina[.]com

PhishDestroy identifies 1win-official-argentina.com as a generic phishing domain actively masquerading as a legitimate betting site targeting Argentina-based users. The domain leverages a look-alike name to mimic a popular gambling brand, likely aiming to harvest credentials or payment data through a fake login or deposit page. No specific drainer kit or JavaScript payload has been exposed in open sources at this time, suggesting the threat actor may be using off-the-shelf phishing templates with regional localization. Given the domain’s naming convention and lack of association with a known legitimate entity, this appears to be a newly staged campaign with minimal infrastructure reuse.

Technical indicators confirm elevated risk: the domain resolves to 104.21.53.146 and was registered on April 04, 2026, through Fewmoretaps OU d/b/a Trustname.com. The SSL certificate, issued by Let’s Encrypt, provides a false sense of legitimacy. VirusTotal currently shows 1/95 detections, indicating it remains undetected by most antivirus engines. While Google Safe Browsing (GSB) status is not yet flagged and public blocklists show zero listings, the domain remains active and under active investigation by PhishDestroy analysts. At present, it has not been subjected to takedown or remediation efforts.

Current status is active with no confirmed takedown. Security teams are advised to block 1win-official-argentina.com at the DNS and network levels using the IP 104.21.53.146 and the domain name. Organizations are encouraged to monitor for related infrastructure and update user awareness regarding Argentina-themed gambling scams. The risk level remains under investigation, but given the domain’s recent creation and zero detections, it is likely to escalate quickly. Immediate defensive action is strongly recommended to prevent user exposure.