luxurywinclub[.]live

The domain luxurywinclub.live was observed as part of a high‑risk generic phishing campaign and is currently offline. Analysis indicates that the site presented itself as an online casino claiming blockchain integration, as reflected in the page title "LUXURYWINCLUB | Play at the best online casino based on Blockchain." The infrastructure resolves to the IPv4 address 69.5.189.54, which is allocated to the Autonomous System number 42624 operated by Global-Data System IT Corporation in Switzerland. No TLS certificate was presented, meaning the site was served over plain HTTP, a common characteristic of low‑cost phishing deployments. Registration details show the domain was provisioned through the SC‑GLOBAL‑DATA‑20040120 registrar, and the authoritative name servers are ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, and ns4.nameserverhub.com.

VirusTotal recorded ten detections out of ninety‑five scanned engines, indicating that multiple security vendors flagged the domain as malicious. AlienVault Open Threat Exchange listed the domain in a single threat‑intel pulse, and it appears on one public blocklist as well as being blocked by PhishDestroy. Google Safe Browsing classified the URL as a social engineering threat, reinforcing the phishing assessment.

The campaign employed the publicly available Gambler Scam phishing kit, aligning with the crypto‑scam categorisation supplied in the intelligence. While the domain is no longer reachable, the observed indicators—IP address, registrar, name servers, detection counts, and kit usage—should be incorporated into defensive controls. Network defenders are advised to update URL filtering, DNS sink‑hole, and intrusion detection signatures to include the identified IP and domain, monitor for reuse of the same registrar or name‑server pattern, and enforce strict TLS inspection to detect similar HTTP‑only phishing sites in the future.