moneygun[.]fun

The domain moneygun.fun was registered on February 21, 2026 and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 172.67.193.139, hosted by Cloudflare (AS13335) in the United States. The site presented the page title “Moneygun: Most Popular Online Crypto Casino Based on Blockchain,” which aligns with the documented scam type of a crypto‑focused phishing operation. Evidence from the known intelligence indicates the site employed the publicly identified “Gambler Scam” phishing kit, a toolkit commonly used to harvest cryptocurrency credentials.

The SSL certificate is identified as “WE1,” confirming that the site used a valid TLS layer despite its malicious purpose. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of trustworthiness. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming its inclusion in curated threat feeds. VirusTotal analysis recorded 12 detections out of 93 scanning engines, providing additional independent confirmation of malicious activity.

No further public content analysis (e.g., page markup or visual elements) is available, so the exact user‑facing content cannot be described beyond the page title. Defenders should add moneygun.fun to domain‑level deny lists, block its resolving IP 172.67.193.139, and ensure TLS inspection policies flag the WE1 certificate when used in other contexts. Continuous monitoring of Cloudflare‑hosted IP ranges for similar phishing kits is recommended, as is periodic re‑query of threat intelligence feeds for any resurgence of the domain or related indicators.