regalspin[.]world

The domain regalspin.world was registered on 22 February 2026 and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. Authoritative name servers are destiny.ns.cloudflare.com and junade.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. No TLS certificate is presented for the host, and an HTTP request returns an offline status, confirming that the site has been taken down. The page title retrieved from cached metadata reads "Regalspin: Most Popular Online Crypto Casino Based on Blockchain", which aligns with the listed scam type of a crypto‑related scam.

The operation is associated with the publicly‑known "Gambler Scam" phishing kit, a package frequently used to impersonate online gambling platforms and lure victims into disclosing cryptocurrency credentials. Threat intelligence feeds have flagged the domain on a single security blocklist, specifically PhishDestroy, and the domain appears on one additional blocklist. VirusTotal analysis shows that 14 of 95 scanning engines returned a malicious indication, reinforcing the suspicion of malicious intent. The combination of a recent registration date, Cloudflare hosting, absence of a valid SSL certificate, and alignment with a known phishing kit constitutes a credible indicator set for a credential‑harvesting campaign targeting cryptocurrency users.

Uncertainty remains regarding the exact content that was served before the takedown, as only the title and kit attribution have been observed. No further evidence of payload delivery, command‑and‑control infrastructure, or victim interaction is available at this time. Defenders should add regalspin.world to network and email filtering blocklists, monitor for any resurgence of the domain or replicas using the same name‑server pattern, and treat any inbound traffic to the IP as potentially malicious.