VirusTotal
13 / 89
“Wingo: Most Popular Online Crypto Casino Based on Blockchain”
On July 23 2026 the domain wingo.casino was observed hosting a fraudulent crypto‑casino page titled “Wingo: Most Popular Online Crypto Casino Based on Blockchai
L’analyse détaillée de PhishDestroy AI reste en anglais afin de préserver le relevé forensique original.
13 / 89
3 threat-system alerts
Signalermalicious
Signaler1/100
Signaler1 community reference
Signalerprovider verdict: clean
Signalerrapport stocké
Signaler Checked; no threat flag recorded
Signaler| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| OpenDNS | wingo.casino |
phishing | Phishing Block |
| Hagezi Threat Feed | wingo.casino |
malicious | Sinkholed |
| DNS4EU | wingo.casino |
malicious | Sinkholed |
On July 23 2026 the domain wingo.casino was observed hosting a fraudulent crypto‑casino page titled “Wingo: Most Popular Online Crypto Casino Based on Blockchain”. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 172.67.169.241, advertised under AS13335 Cloudflare, Inc. and located in the United States. Registration is handled through Cloudflare, Inc. with authoritative nameservers bart.ns.cloudflare.com and fay.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and proxy services. The site presented an HTTPS certificate issued by Google Trust Services (WE1), confirming the presence of a valid TLS certificate despite the malicious intent. Threat intelligence flags the domain on three independent security blocklists and it is actively blocked by PhishDestroy, MetaMask and SEAL.
VirusTotal scans returned 15 positive detections out of 95 vendors, and the Gridinsoft trust score is 1 / 100, reflecting a highly suspicious reputation. AlienVault OTX references the domain in a single threat‑intel pulse, further corroborating its malicious nature. The HTTP response code reported was 666, an uncommon status that may be employed to evade standard monitoring. The observed phishing kit matches the “Gambler Scam” profile, and the campaign is classified as a crypto‑scam targeting users seeking cryptocurrency gambling services.
Current operational status is offline, which may be temporary or the result of takedown actions. Uncertainty remains regarding the exact victim interaction flow, as the page content has not been publicly archived. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑registration or use of sibling domains, and update endpoint protection signatures to include the observed IP address and associated SSL fingerprint. Ongoing collection of any new indicators, such as URL patterns or payload hashes, is recommended to maintain coverage against potential re‑emergence.
Enregistrement des observations « crawler contre navigateur » pour cet hôte, ainsi qu'une vérification en temps réel des empreintes numériques pour les systèmes de répartition du trafic de type Keitaro.
Note relative à la numérisation: unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='wingo.casino', port=80): Max retries exceeded with url: / (Caused by NewConnectionError("S
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
La réputation Edge-IP n’est pas attribuée à ce domaine.
bart.ns.cloudflare.comfay.ns.cloudflare.comLocation describes the IP network.
c98b2e65afebc2266b8556e06429e60fe1a5fb3c3fc95b1d07aaf0825001d84fSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
31 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
Signalé par 1 membre de la communauté ; première observation le 01/11/2025
PD-1767733771-wingo.casino Recipient: abuse@spaceship.com Si vous avez saisi des informations d'identification de compte, des informations personnelles ou de paiement, ou téléchargé un fichier à partir de ce domaine, agissez immédiatement. Vous trouverez ci-dessous des ressources pour vous aider à signaler l'incident et à vous protéger.
Sélectionnez votre pays pour obtenir contacts officiels en matière de cybercriminalité ou créer un projet de plainte →.
Template-based draft · optional AI wording assistance requires separate consent
Analyse des menaces à l'aide de listes de blocage stockées, de WHOIS, de DNS et de preuves d'analyse publique
Scanner maintenantSignalez les domaines suspects à notre base de données des menaces — protégez la communauté
SignalerRapports de phishing récents et changements de disponibilité observés
SurveillerSurveillez les menaces en temps réel ou signalez cette alerte si vous pensez qu'il s'agit d'un faux positif