Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
ネットワークセキュリティインテリジェンス Registrar context
Registrar contextTrustname
Stored registration data identifies Trustname / Fewmoretaps OÜ (IANA 4318) as the registrar. PhishDestroy maintains a separate registrar investigation; that material is contextual and is not an independent detection for this domain.
Analysis indicates that the domain www.monkwin.com was registered on August 04, 2026 through Fewmoretaps OU d/b/a Trustname.com. The domain is hosted on Cloudflare infrastructure, as evidenced by the authoritative nameservers dan.ns.cloudflare.com and indie.ns.cloudflare.com, and resolves to the IPv4 address 104.21.1.57. VirusTotal scans show that six out of ninety‑one security vendors have flagged the domain, demonstrating a moderate detection consensus. The domain is presently listed on one external security blocklist and has been actively blocked by the PhishDestroy service, confirming that it is being treated as malicious by at least one commercial filtering product. The current operational status is reported as “active,” meaning the site is still reachable and may continue to serve malicious content.
The available intelligence does not include a captured page title, observed SSL certificate details, or traffic behaviour, so the specific phishing lure or targeted brand cannot be confirmed at this time. Consequently, the precise content of the hosted page remains unknown, and any claim about the visual layout or impersonated services would be speculative. Nevertheless, the combination of recent registration, Cloudflare hosting, partial vendor detections, and inclusion on a blocklist aligns with typical infrastructure patterns used for short‑lived phishing campaigns. Defenders should prioritize immediate containment measures. Network perimeter devices and DNS resolvers ought to deny or sinkhole queries for www.monkwin.com and its associated IP address 104.21.1.57.
Endpoint protection solutions that integrate threat‑intelligence feeds should be updated to reflect the six vendor detections and the blocklist entry. Continuous monitoring of Cloudflare‑hosted IP ranges for anomalous traffic may help identify related campaigns. Because the domain was only created three days ago, rapid revocation of any credentials entered by users is advisable.
DOM Analysisanalyzed 2026年8月7日score 98/1001 brand signal
Submitted URLhttps://www.monkwin.com/
Favicon Hash
ICANN OVERSIGHT
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprint796df8eeaa4d0f821c18cfb0ba70af4a2d78c2565f6443616a96d82008c1ca35Certificate names · 1 SANs
monkwin.com
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
This domain markets casino/gambling services. Scam casinos routinely display fake Curaçao, MGA, or Kahnawake license badges that don’t exist in the real registries. Always verify the license number against the official regulator database before depositing. If the site shows a seal but no clickable registry link — or the linked registry page doesn’t exist — treat it as fraudulent.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(BY)
PhishDestroy Investigation
