rywin[.]cc

On 23 July 2026, the domain rywin.cc was observed being used for a crypto‑related phishing campaign. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and delegated to the Cloudflare nameservers paul.ns.cloudflare.com and tegan.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:3031::6815:2619, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site employed a TLS certificate issued by Google Trust Services under the WE1 label, indicating standard HTTPS support. The page title returned by the server was “Rywin: Most Popular Online Crypto Casino Based on Blockchain”, matching the declared scam type of a crypto scam and the known “Gambler Scam” phishing kit.

Reputation checks show a Gridinsoft trust score of 1 out of 100 and the domain appears on a single security blocklist. VirusTotal scans recorded 16 detections out of 93 submitted security vendors, confirming malicious classification. The domain is currently listed as offline, and PhishDestroy has actively blocked it. Evidence confirms that rywin.cc was deliberately crafted to lure victims into a fraudulent cryptocurrency casino environment. The combination of a low trust score, multiple vendor detections, presence on a blocklist, and active blocking by PhishDestroy demonstrates a high confidence of malicious intent.

However, no detailed content analysis beyond the page title is available, and the specific phishing payload or credential harvesting mechanisms have not been captured. Defenders should add the domain and its associated IPv6 address to network blocklists, enforce DNS filtering for the Cloudflare nameservers, and monitor for any re‑registration attempts. Continuous observation of the registrar NiceNIC and the Cloudflare namespace is recommended to detect potential resurgence.