# rendacheng.com: Recorded 1win Venezuela Betting and Casino Page | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/rendacheng.com/ Machine-readable companion: https://phishdestroy.io/domain/rendacheng.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-11-02 15:53:31 UTC - Selected availability observation: 2026-11-02T15:53:31Z - Stored record updated: 2026-11-02 17:57:57 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 172.67.219.96 - Registrar in stored WHOIS data: DEVEXPANSE LTD d/b/a Regery.com - Registrar country in stored WHOIS data: UA - Last stored HTTP status: 200 (observed: 2026-11-02T15:53:31Z) - Registration date in stored WHOIS data: 2026-10-07 10:46:28 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a19cf5-5c7c-72f0-a66a-d2f072e1ac3c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rendacheng.com - Certificate Transparency search: https://crt.sh/?q=%25.rendacheng.com - Web Archive lookup: https://web.archive.org/web/*/https://rendacheng.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records the page at rendacheng.com showing a 1win Venezuela sports betting and casino landing page with registration and login options. On 2026-11-02, the page at rendacheng.com displayed a Spanish-language landing page branded as 1win Venezuela, a sports betting and casino site. The header offers "Iniciar sesión" (log in) and "Registro" (registration) buttons alongside promotional cards advertising up to 30% casino cashback and a 500% bonus. Below, category tiles link to TVBET live games, casino titles, live dealer games, and poker, followed by a section headed "1win Venezuela – Apuestas deportivas y casino online" with descriptive text about the platform's sports betting and casino offerings. The stored VirusTotal domain result reports 16 detections out of 92 engines. DNS8 reported "suspicious"; ESET reported "suspicious". Package revision: 657cba4d62d88fbd909bd01e57b9e678ff14faec505b85394c503810fa003c3b Text generated (not scan time): 2026-11-02 17:31:30 Reviewed evidence snapshot: {"domain":"rendacheng.com","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"rendacheng.com","final_host":"rendacheng.com","redirects":[],"captured_at":"2026-11-02T16:28:20Z","uuid":"3a9cc1ba-76aa-4327-b222-b87bfb073314","report_url":"https://radar.cloudflare.com/scan/3a9cc1ba-76aa-4327-b222-b87bfb073314","sha256":"84e842f966f657b48e63d1997d46f389360511bf4a4648c199a522eccf410b32","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","virustotal":{"scope":"domain","detections":16,"engines":92,"malicious":14,"suspicious":2,"analysis_date":"2026-10-25","retrieved_date":"2026-11-02","vendor_labels":{"DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","URLQuery":"malicious","Seclookup":"malicious","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"flagging_vendors":["DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","CyRadar","Webroot","Fortinet","SOCRadar","URLQuery","Seclookup","BitDefender","Chong Lua Dao","alphaMountain.ai","Forcepoint ThreatSeeker"]},"virustotal_public_summary":"The stored VirusTotal domain result reports 16 detections out of 92 engines. DNS8 reported \"suspicious\"; ESET reported \"suspicious\".","page_paragraph_target_characters":546} Source facts (timestamps as stored): {"record_id":1748879,"first_recorded_at":"2026-11-02 16:53:31","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":16,"denominator":92,"malicious":14,"suspicious":2,"vendors":{"DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","URLQuery":"malicious","Seclookup":"malicious","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-25T15:20:38Z","checked_at":null,"fetched_at":"2026-11-02T16:27:32Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":16,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","Chong Lua Dao","CyRadar","DNS8","ESET","Forcepoint ThreatSeeker","Fortinet","G-Data","Lionic","Seclookup","SOCRadar","Sophos","URLQuery","VIPRE","Webroot"],"observed_at":"2026-10-25 15:20:38","checked_at":"2026-11-02 17:27:33","fetched_at":"2026-11-02 16:27:33","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","URLQuery":"malicious","Seclookup":"malicious","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"vendor_names":["DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","CyRadar","Webroot","Fortinet","SOCRadar","URLQuery","Seclookup","BitDefender","Chong Lua Dao","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":45,"malicious":14,"suspicious":2,"undetected":31}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-02 17:27:56"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":null},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1748879,"scope":"checked_url","observed_at":"2026-11-02T15:53:31Z","http_status":200,"http_observed_at":"2026-11-02T15:53:31Z","stored_http_code":200,"stored_http_observed_at":"2026-11-02T15:53:31Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - URLScan · 2026-11-02: https://screenshots.phishdestroy.io/01a19cf5-5c7c-72f0-a66a-d2f072e1ac3c.png Captured: 2026-11-02 15:51:38 UTC Source report: https://urlscan.io/result/01a19cf5-5c7c-72f0-a66a-d2f072e1ac3c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3a9cc1ba-76aa-4327-b222-b87bfb073314.png Captured: 2026-11-02 16:28:20 UTC Source report: https://radar.cloudflare.com/scan/3a9cc1ba-76aa-4327-b222-b87bfb073314 SHA-256: 84e842f966f657b48e63d1997d46f389360511bf4a4648c199a522eccf410b32 - URLQuery: https://screenshots.phishdestroy.io/uq/2ae7c822-d07e-4368-8f5e-d1a40a2b0da0.png Source report: https://urlquery.net/report/2ae7c822-d07e-4368-8f5e-d1a40a2b0da0 SHA-256: 9399af33768477742a3acef2d35629bc9cd2f0e9b17963c751128eb15dfd7637 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-02T15:54:52Z", "uuid": "01a19cf5-5c7c-72f0-a66a-d2f072e1ac3c", "scanned_at": "2026-11-02T15:51:38Z", "final_url": "https://rendacheng.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://rendacheng.com/", "from": "http://rendacheng.com/", "status": 307 }, { "to": "http://rendacheng.com/", "from": "https://rendacheng.com/", "status": 307 }, { "to": "https://rendacheng.com/", "from": "http://rendacheng.com/", "status": 307 } ], "ip": "172.67.219.96", "ips": [ "172.67.219.96" ], "asns": [ "13335" ], "doc_hash": "e594cd1b2d84bbc3000514e18ed49bc8653a58b4509e06fd77fc00c86fe7a439", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "be5e847e3d4dc398d51e5f916685ca8b054d9feefbeb9b1c25985513fb676224", "d3690a3d205dde412b6ab7924312362cf1eaa0517ac539dca413d8c062627499", "33731f689dadebc05c05ef9e45c60c75ea4723aad6a2697dc3cf37ecf4c8f819", "f6fc5f0176a534aafba3a4aaffa694eec474b0a275ebc5aab09675db8f7fa5ca" ], "globals": [ "_wpemojiSettings", "$", "jQuery", "image_save_msg", "no_menu_msg", "smessage", "disableEnterKey", "wccp_free_iscontenteditable", "disable_copy", "disable_copy_ie", "reEnable", "disableSelection", "onlongtouch", "touchduration", "elemtype", "touchstart", "touchend", "wccp_pro_is_passive", "nocontext", "show_wpcp_message", "hide_message", "Swiper", "bannersEl" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "*.rendacheng.com", "rendacheng.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "rendacheng.com", "protocol": "TLS 1.3", "valid_to": "2027-01-05T12:03:07Z", "valid_from": "2026-10-07T12:03:08Z" }, "domain_age_days": 1356, "apex_age_days": 1356, "tls_age_days": 26, "tls_valid_days": 89, "requests": 52, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 79, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "1win" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "1win" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.3.36", "link": "; rel=\"https://api.w.org/\"\n; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\"\n; rel=shor" } }, "cf": { "v": 1, "fetched_at": "2026-11-02T16:30:57Z", "uuid": "3a9cc1ba-76aa-4327-b222-b87bfb073314", "scanned_at": "2026-11-02T16:28:20Z", "final_url": "https://rendacheng.com/", "status": 200, "history": [ { "url": "https://rendacheng.com/", "status": 200 } ], "dom_hash": "892ffbe1496fcf2a293fa70f2f77a6c448e4654b12f051d4867c2867055d16ca", "doc_hash": "a2d47178bbb45da60b29c4a497ee4dbe47dd298091a3af84f4ca24a815bb6fbe", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rendacheng.com", "type": "A", "value": "104.21.43.47" }, { "name": "rendacheng.com", "type": "A", "value": "172.67.219.96" }, { "name": "rendacheng.com", "type": "AAAA", "value": "2606:4700:3030::6815:2b2f" }, { "name": "rendacheng.com", "type": "AAAA", "value": "2606:4700:3037::ac43:db60" } ], "dnssec_valid": false, "ip": "127.0.1.5", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "DEVEXPANSE LTD d/b/a Regery.com", "created": "2026-10-07T12:46:28Z", "updated": "2026-10-07T12:58:15Z", "expires": "2027-10-07T12:46:28Z", "nameservers": [ "jamie.ns.cloudflare.com", "sri.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-02T16:27:32Z", "analysis_at": "2026-10-25T15:20:38Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 14, "suspicious": 2, "undetected": 31 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "URLQuery": "malicious", "Seclookup": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)" }, "registrar": "DEVEXPANSE LTD d/b/a Regery.com", "created": "2026-10-07T12:46:28Z", "expires": "2027-10-07T12:46:28Z", "updated": "2026-10-07T12:58:15Z", "first_seen": "2024-03-04T20:43:58Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:2b2f" }, { "ttl": 300, "type": "A", "value": "104.21.43.47" }, { "ttl": 21600, "type": "NS", "value": "sri.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jamie.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.219.96" }, { "ttl": 21600, "type": "NS", "value": "jamie.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:db60" } ], "dns_at": "2026-10-25T15:21:57Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.rendacheng.com", "rendacheng.com" ], "issuer": "Let's Encrypt / YE1", "serial": "65e8441cc39bfc09aeb4db87cae422f18a8", "sha256": "295eafc2f38bd6e567d4fc59d50d52093ac95b75e284f95a1278ee0bbffdb0ce", "subject": "rendacheng.com", "valid_to": "2027-01-05T12:03:07Z", "valid_from": "2026-10-07T12:03:08Z" }, "whois": { "registrar": "DEVEXPANSE LTD d/b/a Regery.com", "registrar_iana_id": "4342", "registrar_url": "https://regery.com", "created": "2026-10-07T12:46:28Z", "updated": "2026-10-07T12:58:15Z", "expires": "2027-10-07T12:46:28Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jamie.ns.cloudflare.com", "sri.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2026-10-07T12:46:28Z", "registrar expiration": "2027-10-07T12:46:28Z", "last update of RDAP database": "2026-10-07T12:58:53Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-11-02T15:54:36Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "rendacheng.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-02-09T15:27:50Z", "first": "2025-07-10T01:34:23Z", "changes": 2, "days_archived": 4, "scans_per_day": 0.01, "avg_page_bytes": 4474 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://1win-official.io/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 13 }, "social_tags": { "ogUrl": "https://rendacheng.com/", "title": "1Win - 1Win ES", "ogType": "website", "robots": "noindex, nofollow", "ogImage": "https://rendacheng.com/wp-content/uploads/2024/08/1Win-About.webp", "ogTitle": "1Win - 1Win ES", "generator": "WordPress 6.8.11", "ogSiteName": "1Win ES", "twitterCard": "summary_large_image", "canonicalUrl": "https://rendacheng.com/", "ogDescription": "1win Venezuela – Apuestas deportivas y casino online 1win Casino Venezuela representa la evolución del entretenimiento digital en el país, combinando apuestas deportivas de alto calibre con experiencias de casino online inmersivas. Esta plataforma internacional ha conquistado el mercado venezolano g" }, "trackers": { "requests": 50 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 34, "tls": 26, "wait": 89, "connect": 47, "download": 128 }, "response_ms": 324 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 234950, "co2_grams": 0.0086, "cleaner_than": 3 }, "dns_server": { "ns": [ { "ip": "172.64.33.234", "host": "sri.ns.cloudflare.com" }, { "ip": "108.162.192.168", "host": "jamie.ns.cloudflare.com" } ], "zone": "rendacheng.com" }, "location": { "ip": "2606:4700:3030::6815:2b2f", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "rendacheng.com" }, "dns": { "A": [ "104.21.43.47", "172.67.219.96" ], "NS": [ "jamie.ns.cloudflare.com", "sri.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"jamie.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417473848, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3037::ac43:db60", "2606:4700:3030::6815:2b2f" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3030::6815:2b2f", "family": 6 }, "redirects": { "chain": [ "https://rendacheng.com" ] }, "subdomains": { "count": 2, "subdomains": [ "fans.rendacheng.com", "lit.rendacheng.com" ] }, "linked_pages": { "internal_count": 3 }, "whois": { "registrar": "DEVEXPANSE LTD d/b/a Regery.com", "created": "2026-10-07T12:46:28Z", "updated": "2026-10-07T12:58:15Z", "expires": "2027-10-07T12:46:28Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "jamie.ns.cloudflare.com", "sri.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.3.36", "link": "; rel=\"https://api.w.org/\", ; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", ; rel=shortlink" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/cf/3a9cc1ba-76aa-4327-b222-b87bfb073314.png","source":"Cloudflare Radar","report_url":"https://radar.cloudflare.com/scan/3a9cc1ba-76aa-4327-b222-b87bfb073314","captured_at":"2026-11-02T16:28:20Z","sha256":"84e842f966f657b48e63d1997d46f389360511bf4a4648c199a522eccf410b32","model_image_sha256":"42fc47878716695113f91dd8bbf0004760850edbe03135787d1b86a99be8c81a","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/rendacheng.com/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/rendacheng.com/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/rendacheng.com/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/rendacheng.com/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/rendacheng.com/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/rendacheng.com/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/rendacheng.com/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/rendacheng.com/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1748879, "scope": "checked_url", "observed_at": "2026-11-02T15:53:31Z", "http_status": 200, "http_observed_at": "2026-11-02T15:53:31Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-02T15:53:31Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "unknown", "content_classification_at": null, "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```