# PhishDestroy threat dossier — simsinos-bonus-casino.com ================================================================ Fetched: 2026-06-07 02:53:07 UTC Canonical: https://phishdestroy.io/domain/simsinos-bonus-casino.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Gridinsoft URLQuery: 2 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.46.120 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Fewmoretaps OU d/b/a Trustname.com !!! REGISTRAR INTEGRITY ALERT — Trustname / Fewmoretaps OU !!! Trustname (IANA #4318) is a shell company declaring EUR 120 annual revenue, 1 employee, negative equity, Belarusian ownership. Explicitly advertises itself as 'bulletproof' in its DNS TXT records. Primary source: https://phishdestroy.io/trustname-bulletproof-exposed Nameservers: ["kanye.ns.cloudflare.com", "karina.ns.cloudflare.com"] Registered: 2026-04-28 Page title: Simsinos casino en ligne : avis France, bonus, paiements & app ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-06-03 Status: INVALID chain Fingerprint: 62434264b4be4b593a8b14dec60dd5feb44176bff150fc615d9208ba8da90387 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-28 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-28 19:00:14 UTC (by PhishDestroy tracker) First reported: 2026-04-28 16:26:55 UTC (abuse notice filed) Last verified: 2026-06-02 19:40:16 UTC Neutralised: 2026-06-06 17:33:52 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dd4d0-140d-744a-adf3-5df605d70a0b/ URLQuery: https://urlquery.net/report/ea0790cd-7814-41cc-a335-4217e5e97ac7 Wayback Machine: https://web.archive.org/web/*/simsinos-bonus-casino.com crt.sh CT logs: https://crt.sh/?q=%25.simsinos-bonus-casino.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=simsinos-bonus-casino.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/simsinos-bonus-casino.com URLhaus: https://urlhaus.abuse.ch/host/simsinos-bonus-casino.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-28 19:02:29 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies simsinos-bonus-casino.com, a generic phishing domain posing as a crypto bonus casino. The domain is currently active and presents an elevated risk to users. This domain, simsinos-bonus-casino.com, was created on March 05, 2026 and is currently flagged by 1 of 95 VirusTotal security vendors. The domain resolves to IP 104.21.46.120 and was registered through Fewmoretaps OU d/b/a Trustname.com. VirusTotal data indicates 1 blocklist count with trust scores dropping due to malicious indicators. Simsinos-bonus-casino.com presents generic phishing threats targeting online casino users. The domain was registered through Trustname.com, posing as a legitimate registrar. Technical indicators reveal a Let's Encrypt SSL certificate, created on March 05, 2026 and resolving to IP 104.21.46.120, currently associated with fraudulent activities. Current status indicates active phishing operations with a Let's Encrypt SSL certificate. This domain was flagged by 1 of 95 VirusTotal vendors as a generic phishing threat, presenting elevated risks to unsuspecting users. Technical analysis shows a recently created domain with a valid SSL certificate, designed to deceive and extract sensitive information. PhishDestroy recommends immediate verification and blocking of this domain. Users should avoid clicking any links or entering credentials on simsinos-bonus-casino.com. Concrete safety guidance includes reporting this domain to PhishDestroy for immediate action and awareness. Threat analysis reveals generic phishing targeting online casino platforms. Technical indicators show a valid SSL certificate through Let's Encrypt, designed to appear legitimate. Risk assessment indicates 1 of 95 VirusTotal vendors flagging this domain, suggesting potential widespread fraudulent activities. Actionable safety guidance includes verifying this domain on PhishDestroy before any interactions. Users should block this domain at the network level using IP 104.21.46.120 as a technical indicator. Concrete recommendations involve reporting this domain to PhishDestroy for immediate takedown and public awareness. Risk level for simsinos-bonus-casino.com is elevated due to active phishing operations targeting online casino users. This domain presents specific threats designed to deceive and extract sensitive information from unsuspecting victims. Technical analysis supports immediate verification and reporting to PhishDestroy for safety and security. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260428-CB0536 Favicon MD5: d099417133de2c4334294e2f55e1e234 TLS cert SHA-256: 62434264b4be4b593a8b14dec60dd5feb44176bff150fc615d9208ba8da90387 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/simsinos-bonus-casino.com/ JSON API: https://api.destroy.tools/v1/check?domain=simsinos-bonus-casino.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 157,760 domains (42,528 alive under monitoring, 114,263 confirmed takedowns/dead). Site: https://phishdestroy.io