# PhishDestroy domain threat record: roll2win.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/roll2win.net/
Machine-readable companion: https://phishdestroy.io/domain/roll2win.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 12:19:19 UTC
- Last availability or vendor check: 2026-10-26 12:19:19 UTC
- Stored record updated: 2026-10-26 20:15:47 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.64.171
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 307
- Registration date in stored WHOIS data: 2026-06-25 19:19:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17824-ad90-70eb-a30b-84e04d506364/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/roll2win.net
- Certificate Transparency search: https://crt.sh/?q=%25.roll2win.net
- Web Archive lookup: https://web.archive.org/web/*/https://roll2win.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
As observed on 2026-10-26, the captured screenshot shows a dark blue Greek-mythology casino landing page with large Zeus-style lightning artwork, a ROLL2WIN.NET logo at the top, and a Create an Account panel with Email, Create Password and Promo Code fields above a blue Sign Up button. Below the hero image the page presented the heading How to receive your free bonus above three empty step cards. PhishDestroy classified roll2win.net as a credential phishing page, first seen on 2026-10-26.

How the scam works
The page pairs a free bonus promise with an account-creation form, so a visitor who supplies an email address and a chosen password hands over credentials that are reusable elsewhere. The promo code field and step cards lend the request a plausible casino sign-up appearance, and this category of page typically collects sign-up secrets rather than delivering any bonus.

Evidence
The screenshot confirms the English-language sign-up form and free-bonus lure, with no wallet interaction observed. urlscan marked the capture malicious with an ML score of 95 on 2026-10-26 after three 307 redirects ending at an authentication path on the same domain; VirusTotal flagged roll2win.net as malicious with Gridinsoft labelling it phishing. Spamhaus listed roll2win.net as phishing on 2026-10-26, OTX recorded 3 pulses, external blocklists recorded 0 listings and Google Safe Browsing was not flagged, all checked on 2026-10-26, while PhishDestroy's internal blocklist flags it. Inspection recorded TanStack Router and Sentry globals, Facebook and Cloudflare Insights trackers, and 10 distinct script SHA256 hashes for campaign pivoting, one beginning 4ccea564c13b.

Infrastructure
roll2win.net was registered on 2026-06-25 through NICENIC INTERNATIONAL GROUP CO., LIMITED, with recorded DNS and hosting on Cloudflare, whose WAF was detected. Weaknesses: CSP and HSTS absent, DNSSEC unsigned, no SPF, DKIM or DMARC; TLS 1.3 with AES-256-GCM, forward secrecy and ALPN h2; X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy and Permissions-Policy present; CAA present.

What to do
If you submitted an email and password, change that password on the genuine service you use and enable two-factor authentication, and treat bonus or promo messages linked to this domain as phishing. Security teams should block roll2win.net at DNS or proxy level, hunt for the sign-up lure and the recorded script hashes, and monitor for credential reuse.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17824-ad90-70eb-a30b-84e04d506364/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8327a3b5-57d8-48e1-a180-4fff4dd354f7
Stored capture screenshot: https://i.ibb.co/8DWJy72Y/33e7bea4377f.png
Cloudflare Radar screenshot (2026-10-26T12:52:08Z): https://screenshots.phishdestroy.io/cf/8327a3b5-57d8-48e1-a180-4fff4dd354f7.png
VirusTotal report: https://www.virustotal.com/gui/domain/roll2win.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=roll2win.net
Archived copy: https://web.archive.org/web/20261026122123/https://roll2win.net/auth/second
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:15:47 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/8DWJy72Y/33e7bea4377f.png
  Captured: 2026-10-26 12:19:19 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17824-ad90-70eb-a30b-84e04d506364.png
  Captured: 2026-10-26 12:19:19 UTC
  Source report: https://urlscan.io/result/01a17824-ad90-70eb-a30b-84e04d506364/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8327a3b5-57d8-48e1-a180-4fff4dd354f7.png
  Captured: 2026-10-26 12:52:08 UTC
  Source report: https://radar.cloudflare.com/scan/8327a3b5-57d8-48e1-a180-4fff4dd354f7
  SHA-256: ed33e3671040e2d3258f8187f51c2b42a7011870590bc15f81a7a5847ed53553

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T12:52:33Z",
        "uuid": "01a17824-ad90-70eb-a30b-84e04d506364",
        "scanned_at": "2026-10-26T12:19:06Z",
        "final_url": "https://roll2win.net/auth/second",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://roll2win.net/",
                "from": "http://roll2win.net/",
                "status": 307
            },
            {
                "to": "https://roll2win.net/auth",
                "from": "https://roll2win.net/",
                "status": 307
            },
            {
                "to": "https://roll2win.net/auth/second",
                "from": "https://roll2win.net/auth",
                "status": 307
            }
        ],
        "ip": "172.64.80.1",
        "domains": [
            "connect.facebook.net",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "57.144.180.128",
            "104.16.80.73",
            "172.64.80.1"
        ],
        "asns": [
            "32934",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "4dd2b30f7bf02ae5362a347aee402720600b05b0282905bcfd0b3225917686ce",
        "script_hashes": [
            "4ccea564c13b57011edb5ca9e38f6d658e765b50f85fd0f948bf691f3a45e7e8",
            "debd3c4ed9ef60facb613486a740b15b415e5c4d0a83b0bb8149ee6a1fb31486",
            "dc5002855128e75204eaf72b14be546a9a8054f6a147609bad432abf40c35038",
            "0d9ea614dc437bb04fd1774a65987a82292fbaec02b08d65e25e8b85d872da88",
            "ced39053d4fb6ecf33d98551ec24f63641d7230f6f9171ad09e669440aad0916",
            "976c627c059148569256cde189242e3d48cbdced38f8f3304e4327e1a6ab1ef2",
            "0fef9fea9f846c83f110c3fb43ca999f0ec5af1ad9d300257fdd0cb8360e2f3b",
            "161af1d29d9d35c92c806eb72fdfb9b4aa75ed20bde882649a9ed20486eff4ad",
            "d79474635d2a5fddfea4f74fbcd168be27fa6a40545ef2d801cf146121cd41c1",
            "b5485a734ca4ad4b548c66826c64f0e4056262dd5dfb2c4208d16d7e2008be7c"
        ],
        "globals": [
            "$R",
            "fbq",
            "_fbq",
            "__cfBeacon",
            "createFileRoute",
            "createLazyFileRoute",
            "__TSR_ROUTER__",
            "__SENTRY__",
            "__sentry_instrumentation_handlers__",
            "__TSS_START_OPTIONS__",
            "__TSR_ROUTER_CONTEXT__"
        ],
        "cookies": [
            "landing_visitor",
            "landing_choice",
            "_fbp"
        ],
        "storage_keys": [
            "lastExternalReferrer",
            "lastExternalReferrerTime"
        ],
        "tls": {
            "san": [
                "roll2win.net",
                "*.roll2win.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "roll2win.net",
            "protocol": "QUIC",
            "valid_to": "2027-01-19T23:32:31Z",
            "valid_from": "2026-10-21T22:34:39Z"
        },
        "domain_age_days": 2048,
        "apex_age_days": 2048,
        "tls_age_days": 4,
        "tls_valid_days": 90,
        "requests": 31,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T12:52:35Z",
        "uuid": "8327a3b5-57d8-48e1-a180-4fff4dd354f7",
        "scanned_at": "2026-10-26T12:52:08Z",
        "final_url": "https://roll2win.net/auth/second",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://roll2win.net/",
                "status": 307
            },
            {
                "url": "https://roll2win.net/auth",
                "status": 307
            },
            {
                "url": "https://roll2win.net/auth/second",
                "status": 200
            }
        ],
        "dom_hash": "4b56f85b08200f7b9faf6e1356366879052ce7d94079f6b58ad62a7f0aaf6237",
        "doc_hash": "4f6c20ee83a773f7888b470335243f67fedf9b31b35430b6d6046d8d24466b5c",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "roll2win.net",
                "type": "A",
                "value": "172.67.187.48"
            },
            {
                "name": "roll2win.net",
                "type": "A",
                "value": "104.21.64.171"
            },
            {
                "name": "roll2win.net",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:40ab"
            },
            {
                "name": "roll2win.net",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:bb30"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.187.48",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-06-25T21:19:15Z",
            "updated": "2026-06-25T21:19:15Z",
            "expires": "2027-06-25T21:19:15Z",
            "nameservers": [
                "jason.ns.cloudflare.com",
                "kimora.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T12:52:00Z",
        "analysis_at": "2026-10-25T18:49:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "Gridinsoft": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Alexa": 243627,
            "Statvoo": 327487
        },
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-06-25T21:19:15Z",
        "expires": "2027-06-25T21:19:15Z",
        "updated": "2026-06-25T21:19:15Z",
        "first_seen": "2024-03-04T14:42:05Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:bb30"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.64.171"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:40ab"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.187.48"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "jason.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jason.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kimora.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-25T19:52:11Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "roll2win.net",
                "*.roll2win.net"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "432c12200274969a0e64f5fe0f76ee19",
            "sha256": "61f0daeaaa26307e745efab68ba5c1e6cc11e153e15c9f81df360ac30bf1b993",
            "subject": "roll2win.net",
            "valid_to": "2027-01-19T23:32:31Z",
            "valid_from": "2026-10-21T22:34:39Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-06-25T21:19:15Z",
            "updated": "2026-06-25T21:19:15Z",
            "expires": "2027-06-25T21:19:15Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "jason.ns.cloudflare.com",
                "kimora.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-06-25T21:19:15Z",
                "registration": "2026-06-25T21:19:15Z",
                "registrar expiration": "2027-06-25T21:19:15Z",
                "last update of RDAP database": "2026-06-25T21:19:15Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T12:20:06Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "roll2win.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2024-08-16T20:38:40Z",
            "first": "2021-03-17T12:42:22Z",
            "changes": 3,
            "days_archived": 5,
            "scans_per_day": 0,
            "avg_page_bytes": 1594
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "title": "Roll2win",
            "robots": "noindex,nofollow",
            "themeColor": "#0B1019"
        },
        "trackers": {
            "requests": 21,
            "trackers": [
                {
                    "name": "Facebook",
                    "company": "Meta",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 2
                },
                {
                    "name": "Facebook Connect",
                    "company": "Meta",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 307,
            "timings": {
                "dns": 216,
                "tls": 104,
                "wait": 75,
                "connect": 25,
                "download": 0
            },
            "response_ms": 420
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 8693,
            "co2_grams": 0.0003,
            "cleaner_than": 75
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.179",
                    "host": "jason.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.243",
                    "host": "kimora.ns.cloudflare.com"
                }
            ],
            "zone": "roll2win.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "landing_visitor",
                    "same_site": "Lax"
                },
                {
                    "name": "landing_choice",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "_fbp",
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3034::ac43:bb30",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "roll2win.net"
        },
        "dns": {
            "A": [
                "172.67.187.48",
                "104.21.64.171"
            ],
            "NS": [
                "kimora.ns.cloudflare.com",
                "jason.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"jason.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418275819, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3034::ac43:bb30",
                "2606:4700:3035::6815:40ab"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3035::6815:40ab",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://roll2win.net",
                "/auth",
                "/auth/second"
            ],
            "count": 2
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-06-25T21:19:15Z",
            "updated": "2026-06-25T21:19:15Z",
            "expires": "2027-06-25T21:19:15Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "jason.ns.cloudflare.com",
                "kimora.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "x-frame-options": "DENY",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()"
            }
        }
    }
}
```