riowinz[.]lat

This domain, riowinz.lat, was observed hosting a site titled “Riowinz: Most Popular Online Crypto Casino Based on Blockchain”. The content aligns with a crypto‑scam phishing campaign that uses the publicly known Gambler Scam kit. VirusTotal records indicate that nine of ninety‑three scanning engines flagged the domain as malicious, demonstrating partial detection across the security community. The site has been listed on at least one security blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a malicious resource.

Infrastructure analysis shows the domain is served from the Cloudflare network (AS13335) with the IP address 172.67.155.127, and the nameservers kiki.ns.cloudflare.com and matias.ns.cloudflare.com resolve to the same provider. No TLS certificate was presented, meaning the site operated without HTTPS protection. Registration data reveal the domain was created on 26 February 2026 and was registered through Global Domain Group LLC. The domain’s current HTTP status is offline, and it has been taken down, but the historical evidence remains relevant for threat‑intelligence feeds.

Defenders should continue to block riowinz.lat at the DNS and proxy layers, monitor for any re‑use of the associated IP address or nameserver set, and add the observed indicators to internal blacklists. Because the site employed a known gambling‑focused phishing kit, future campaigns may target similar cryptocurrency or gambling‑related victims; threat‑hunting queries that include the page title, the IP 172.67.155.127, or the “Gambler Scam” signature can help surface related activity. At present, no additional payload or command‑and‑control infrastructure has been disclosed, so further investigation is required to determine whether the domain was part of a broader campaign.