caswin[.]pro

On 24 July 2026 the domain caswin.pro was observed as an offline site associated with a crypto‑focused casino phishing campaign. The page title returned by the server was "CASWIN | Play at the best online casino based on Blockchain," indicating the use of a gambling theme to lure victims. Infrastructure analysis shows the domain resolved to the IPv4 address 69.5.189.58, which is registered to the Autonomous System AS42624 operated by Global‑Data System IT Corporation in Switzerland. Registration was performed through the registrar SC‑GLOBAL‑DATA‑20040120, and the domain is served by four nameservers (ns1.nameserverhub.com through ns4.nameserverhub.com). No TLS certificate was presented, meaning the site was accessed over plain HTTP only.

Reputation checks reveal a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 1 / 100, both indicating extreme malicious confidence. VirusTotal recorded 6 detections out of 95 scanned security vendors, reinforcing the malicious classification. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. The phishing kit identified is the "Gambler Scam," which is commonly employed to harvest cryptocurrency credentials or financial information under the pretense of a blockchain casino.

The risk level assigned by the reporting system is elevated, and the unique seed df4e3d links this observation to other related intelligence. While the site is currently offline, the underlying infrastructure—including the IP address, nameserver configuration, and registrar—remains observable and could be reused for future campaigns. Defenders should add the IP 69.5.189.58 to network blocklists, monitor DNS queries for the associated nameservers, and ensure that any corporate email or web filters block the domain caswin.pro. Continuous re‑scanning of the domain is recommended in case the site is re‑hosted, and threat‑intel feeds should be updated with the observed trust scores and detection counts.