pukwin[.]com

On 24 July 2026 the domain pukwin.com was observed hosting a malicious page whose title reads “PUKWIN | Play at the best online casino based on Blockchain”. The site was secured with an SSL certificate issued by Google Trust Services under the WE1 designation, indicating the use of a legitimate certificate chain that does not by itself guarantee safety. The underlying infrastructure is served through Cloudflare, as shown by the presence of Cloudflare‑issued nameservers (bethany.ns.cloudflare.com, jay.ns.cloudflare.com) and the IP address 104.21.96.4, which resolves to AS13335 Cloudflare, Inc., located in the United States. Registration data show the domain was created on 4 August 2025 via Tucows Domains Inc., a registrar commonly used for both legitimate and abusive domains. Static analysis identified the Gambler Scam phishing kit, a known toolkit used to masquerade as online gambling or casino services and to harvest credentials or cryptocurrency payments.

The site returned an HTTP 403 status code at the time of collection, and its current operational state is marked as offline. Reputation services report a Gridinsoft trust score of 1 out of 100, indicating extremely low confidence in the domain’s legitimacy. VirusTotal scans recorded three positive detections out of ninety‑five submitted security engines, confirming that at least a subset of industry‑grade scanners flagged the domain as malicious. Additionally, the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation platform.

Based on the converging evidence—low trust score, detection by multiple AV engines, presence on a blocklist, association with a known gambling‑oriented phishing kit, and the “Crypto Scam” classification—the domain should be considered a confirmed malicious infrastructure component. Defensive measures should include immediate DNS sink‑holing or firewall rule creation to deny traffic to 104.21.96.