# PhishDestroy domain threat record: sloto-cash.ca

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sloto-cash.ca/
Machine-readable companion: https://phishdestroy.io/domain/sloto-cash.ca/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-19 06:51:31 UTC
- Last availability or vendor check: 2026-10-22 10:33:38 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.169.184
- Registrar in stored WHOIS data: Open Provider Inc.
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date (registry RDAP, sloto-cash.ca): 2026-05-14 11:55:44 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0b87d-ac12-732c-8ea6-003bd2223080/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sloto-cash.ca
- Certificate Transparency search: https://crt.sh/?q=%25.sloto-cash.ca
- Web Archive lookup: https://web.archive.org/web/*/https://sloto-cash.ca/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
sloto-cash.ca presents itself as "Sloto Cash Casino Canada" and targets Canadian gamblers with an outsized welcome offer. PhishDestroy classifies it as a fraudulent gambling site and first detected it on 2026-09-19. As of 2026-10-19 the site was still online and serving its casino content.

How the scam works
The page title promises a 400% welcome bonus plus 100 free spins. Offers that large are designed to get players to deposit quickly. Fraudulent casinos of this type usually accept deposits without friction, but withdrawals stall behind shifting wagering rules, surprise "verification" demands or extra fees. The money deposited, plus any ID documents or card details handed over, is what the victim stands to lose. The crypto-focused blocklists that flag this domain suggest it reaches people who pay or play with crypto wallets.

Evidence
Six of 91 VirusTotal engines flagged the domain as of 2026-09-27: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a small share of engines, but it comes from several independent vendors. MetaMask and SEAL both list the domain alongside PhishDestroy, so wallet users browsing through those protections should see a warning. The domain also appears in four AlienVault OTX threat pulses, which shows other researchers have tracked it.

Infrastructure
The domain was registered on 2026-05-14 through Open Provider Inc., roughly four months before PhishDestroy detected it. That gap means the site had time to run and attract players before it was flagged. It sits behind Cloudflare, with the visible address in Canada matching its Canadian targeting, and the true origin server is not exposed. The .ca domain and local branding help it pass as a domestic operator.

What to do
Do not deposit funds or chase a withdrawal by paying any fee or "unlock" charge, because that money is unlikely to come back. If you paid by card, contact your bank promptly to dispute the charge. If you sent crypto, record the transaction details for a report and do not send more. If you uploaded ID documents, watch for identity misuse, and change any password you reused on the site. Defenders should block the domain at DNS and proxy level and treat lookalike casino domains with similar bonus wording as suspect.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0b87d-ac12-732c-8ea6-003bd2223080/
VirusTotal report: https://www.virustotal.com/gui/domain/sloto-cash.ca
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sloto-cash.ca
Archived copy: https://web.archive.org/web/20260919071342/https://sloto-cash.ca/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:47:11 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/KcZ26Dm1/167b2b69e3ab.png
  Captured: 2026-09-19 07:08:51 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0b87d-ac12-732c-8ea6-003bd2223080.png
  Captured: 2026-09-19 07:08:51 UTC
  Source report: https://urlscan.io/result/01a0b87d-ac12-732c-8ea6-003bd2223080/
- URLScan capture 2: https://urlscan.io/screenshots/01a0a8be-4ad3-77c3-a145-86181cd6be65.png
  Captured: 2026-09-19 06:51:31 UTC
  Source report: https://urlscan.io/result/01a0b87d-ac12-732c-8ea6-003bd2223080/
- URLQuery: https://screenshots.phishdestroy.io/uq/7b396149-a0e2-4271-87f1-0413c399892a.png
  Captured: 2026-09-19 07:17:12 UTC
  Source report: https://urlquery.net/report/7b396149-a0e2-4271-87f1-0413c399892a
  SHA-256: 170de0e7a8362cde3e95b21f6c2206a0c7bbad6c69c0a35c1f77c4a7387c3b82
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f1f15d97-c07b-4dc5-ab36-99b1c38565e4.png
  Captured: 2026-09-19 06:54:20 UTC
  Source report: https://radar.cloudflare.com/scan/f1f15d97-c07b-4dc5-ab36-99b1c38565e4
  SHA-256: 84d2965a2b9ca474ed84df62bb85d60c816b996e77b79091d3f5e6142ec8ffd8
- URLScan · 2026-08-30: https://screenshots.phishdestroy.io/us/01a05240-c943-751f-bb34-803e05708a6a.png
  Captured: 2026-08-30 10:39:40 UTC
  Source report: https://urlscan.io/result/01a05240-c943-751f-bb34-803e05708a6a/
  SHA-256: 2b915ed71499be40d6f16705bf3411ee9994f5440e0e90f9a465236adb620892
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07af0-c0a3-77da-acc1-c83983fe30cb.png
  Captured: 2026-09-07 08:16:45 UTC
  Source report: https://urlscan.io/result/01a07af0-c0a3-77da-acc1-c83983fe30cb/
  SHA-256: 2b915ed71499be40d6f16705bf3411ee9994f5440e0e90f9a465236adb620892
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a8be-4ad3-77c3-a145-86181cd6be65.png
  Captured: 2026-09-16 05:44:15 UTC
  Source report: https://urlscan.io/result/01a0a8be-4ad3-77c3-a145-86181cd6be65/
  SHA-256: 2b915ed71499be40d6f16705bf3411ee9994f5440e0e90f9a465236adb620892
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d1f4-9b35-75fc-ab74-029f7bba6583.png
  Captured: 2026-09-24 05:47:53 UTC
  Source report: https://urlscan.io/result/01a0d1f4-9b35-75fc-ab74-029f7bba6583/
  SHA-256: 2b915ed71499be40d6f16705bf3411ee9994f5440e0e90f9a465236adb620892
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a10fdf-ad19-7436-949b-02e0efcd83a7.png
  Captured: 2026-10-06 06:21:28 UTC
  Source report: https://urlscan.io/result/01a10fdf-ad19-7436-949b-02e0efcd83a7/
  SHA-256: 2b915ed71499be40d6f16705bf3411ee9994f5440e0e90f9a465236adb620892
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14ded-c275-7063-b454-ec187920a7f2.png
  Captured: 2026-10-18 07:33:23 UTC
  Source report: https://urlscan.io/result/01a14ded-c275-7063-b454-ec187920a7f2/
  SHA-256: 2b915ed71499be40d6f16705bf3411ee9994f5440e0e90f9a465236adb620892

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:27:10Z",
        "uuid": "01a0b87d-ac12-732c-8ea6-003bd2223080",
        "scanned_at": "2026-09-19T07:07:29Z",
        "final_url": "https://sloto-cash.ca/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://sloto-cash.ca/",
                "from": "http://sloto-cash.ca/",
                "status": 307
            }
        ],
        "ip": "172.67.169.184",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.79.73",
            "172.67.169.184"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "090c1300b49efe858c61063fd2a1140bde5442d5f7ef9d78704bd6e920ca2bc2",
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.sloto-cash.ca",
                "sloto-cash.ca"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "sloto-cash.ca",
            "protocol": "QUIC",
            "valid_to": "2026-12-08T16:02:22Z",
            "valid_from": "2026-09-09T16:02:23Z"
        },
        "domain_age_days": 127,
        "apex_age_days": 127,
        "tls_age_days": 9,
        "tls_valid_days": 89,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 73,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:44Z",
        "uuid": "f1f15d97-c07b-4dc5-ab36-99b1c38565e4",
        "scanned_at": "2026-09-19T06:54:20Z",
        "final_url": "https://sloto-cash.ca/",
        "status": 200,
        "history": [
            {
                "url": "https://sloto-cash.ca/",
                "status": 200
            }
        ],
        "dom_hash": "ee8860d34a12694703ea1c267434917191a563c8f35b6ff4b34c73dacfbc39a0",
        "doc_hash": "090c1300b49efe858c61063fd2a1140bde5442d5f7ef9d78704bd6e920ca2bc2",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "sloto-cash.ca",
                "type": "A",
                "value": "172.67.169.184"
            },
            {
                "name": "sloto-cash.ca",
                "type": "A",
                "value": "104.21.39.64"
            },
            {
                "name": "sloto-cash.ca",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:2740"
            },
            {
                "name": "sloto-cash.ca",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:a9b8"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.169.184",
        "whois": {
            "registrar": "Open Provider Inc.",
            "created": "2026-05-14T11:55:44Z",
            "updated": "2026-07-13T11:58:04Z",
            "expires": "2027-05-14T11:55:44Z",
            "nameservers": [
                "bella.ns.cloudflare.com",
                "doug.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:50:32Z",
        "analysis_at": "2026-10-21T08:56:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Open Provider Inc.",
        "created": "2026-05-14T11:55:44Z",
        "expires": "2027-05-14T11:55:44Z",
        "updated": "2026-07-13T11:58:04Z",
        "first_seen": "2026-05-14T13:13:55Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:2740"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "bella.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "bella.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "doug.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.39.64"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.169.184"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:a9b8"
            }
        ],
        "dns_at": "2026-10-21T08:56:45Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.sloto-cash.ca",
                "sloto-cash.ca"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5cee74c09d099701afbd265f9a729d21e88",
            "sha256": "3f044f15babe375d10d7b1a7a34cbae846a2ac9eadf35b4bc44a2d2ee57b1782",
            "subject": "sloto-cash.ca",
            "valid_to": "2026-12-08T16:02:22Z",
            "valid_from": "2026-09-09T16:02:23Z"
        },
        "whois": {
            "registrar": "Open Provider Inc.",
            "registrar_iana_id": "not applicable",
            "registrar_url": "https://www.openprovider.com/",
            "created": "2026-05-14T11:55:44Z",
            "updated": "2026-07-13T11:58:04Z",
            "expires": "2027-05-14T11:55:44Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "bella.ns.cloudflare.com",
                "doug.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-05-14T11:55:44Z",
                "last changed": "2026-07-13T11:58:04Z",
                "registration": "2026-05-14T11:55:44Z",
                "last update of RDAP database": "2026-10-15T09:35:15Z"
            }
        }
    }
}
```