wintocasino[.]live

Analysis of the domain wintocasino.live, created on June 22, 2026 and currently taken offline, shows multiple indicators of malicious activity. The domain is registered through NameCheap, Inc. and uses Cloudflare name servers (logan.ns.cloudflare.com and martha.ns.cloudflare.com). DNS resolution points to IP address 104.21.69.87, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The SSL certificate presented by the site is issued by Google Trust Services under the WE1 designation, a common certificate for Cloudflare‑protected sites. Infrastructure fingerprints include Cloudflare Browser Insights and the generic Cloudflare service, confirming the use of Cloudflare’s CDN and security stack.

Reputation data indicate the domain appears on three independent security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report that nine of ninety‑one security vendors flagged the domain, reinforcing the suspicion of abuse. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, suggesting an extremely high risk profile. The observed phishing kit is identified as a "Gambler Scam," which aligns with the domain’s naming pattern and the elevated risk level assigned.

While the site is no longer reachable, the documented evidence provides sufficient context for defenders. The combination of recent registration, Cloudflare‑based hosting, low trust score, blocklist presence, and multiple vendor detections points to a deliberately crafted phishing operation. Security teams should continue to block the domain at network perimeter devices, update URL filtering policies, and monitor for any resurgence of the same IP or certificate fingerprint. Threat intelligence feeds should be enriched with the observed indicators—namely the domain name, registrar, IP address, and SSL certificate details—to improve early detection of related campaigns.