winner-casino-fr[.]com

This domain, winner-casino-fr.com, is flagged as an active phishing site specializing in crypto drainer scams, first registered on April 28, 2026. Analysis indicates it employs the Gambler Scam phishing kit, a known framework for fraudulent gambling and cryptocurrency theft operations. The site resolves to IP address 188.114.96.3, hosted behind Cloudflare infrastructure, and uses nameservers arturo.ns.cloudflare.com and tori.ns.cloudflare.com, which are consistent with bulletproof hosting patterns observed in similar campaigns. The SSL certificate is issued by Google Trust Services (WE1), a common choice for malicious domains due to its low barrier to acquisition. The page title, 'Winner Casino - Jouez aux Machines à Sous | 50 Free Spins,' suggests a lure targeting French-speaking users with promises of free spins or gambling incentives, a tactic frequently associated with crypto drainer schemes. While only 2 of 91 security vendors on VirusTotal currently flag this domain, this limited detection does not indicate safety; many phishing domains evade initial scans through rapid rotation or obfuscation. The domain is already blocked by at least one security blocklist, and its Gridinsoft trust score of 0/100 further corroborates its malicious nature. Infrastructure analysis reveals the domain was registered through Fewmoretaps OU, operating under the alias Trustname.com, a registrar previously linked to high volumes of fraudulent domains. The use of Cloudflare Browser Insights and HTTP/3 may be attempts to mimic legitimate traffic patterns or evade detection. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Given the crypto drainer classification, users who may have interacted with the site should be advised to audit their cryptocurrency wallets for unauthorized transactions.