winslots[.]world

Analysis indicates that winslots.world is an active high‑risk phishing infrastructure targeting users with a crypto gambling lure. The site was registered through NameCheap on 26 September 2025 and resolves to the Cloudflare‑managed address 172.67.136.107, AS13335, located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 authority, and the domain is served through Cloudflare’s edge network using HTTP/3 and Cloudflare Browser Insights. The public page title reads “Jewel Bling! – Block Puzzle,” which aligns with the reported crypto‑gambling scam type. The domain appears on one security blocklist and is listed by PhishDestroy as blocked. AlienVault OTX references the domain in 23 threat‑intel pulses, and VirusTotal reports three detections out of ninety‑five scanners. Nameservers are mitch.ns.cloudflare.com and piper.ns.cloudflare.com. No additional content analysis is available; therefore the exact phishing vector, credential collection method, or malicious payload has not been confirmed. Defenders should treat winslots.world as malicious, enforce DNS or proxy blocking, monitor traffic to the associated IP, and consider adding the domain to intrusion‑prevention rules. Continuous observation of Cloudflare‑originated infrastructure is advised, as the attacker may reuse the same IP range for future campaigns.