trywand[.]cc

On 22 July 2026, investigators observed the domain trywand.cc hosting a page titled “Trywand: Elon Musk’s Official Crypto Casino Powered by Blockchain”. The site was registered through NiceNIC International Group Co., Limited on 6 March 2026 and resolves to the IP address 188.114.97.3, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. The domain uses Cloudflare’s DNS service, with authoritative nameservers imani.ns.cloudflare.com and yew.ns.cloudflare.com, and presents an SSL certificate issued to Internet Widgits Pty Ltd. Automated analysis identified the “Gambler Scam” phishing kit, consistent with the declared crypto‑scam classification. VirusTotal scanned the host and reported a single positive detection out of 95 security vendors.

The domain is listed on at least one public security blocklist and has been specifically blocked by the PhishDestroy service. Current HTTP probing indicates the site is taken offline, which may be a temporary takedown or a deliberate shutdown after detection. The available evidence confirms that the infrastructure is built on a reputable CDN, which can obscure the true origin of the malicious payload. The presence of a single VirusTotal detection suggests limited exposure, but the use of a known gambling‑related phishing kit and the targeting of high‑profile branding in the page title raise concerns for credential harvesting and cryptocurrency fraud.

Uncertainty remains regarding any additional hosting or fallback servers, as no secondary IPs have been observed and the domain’s activity after the offline status has not been publicly disclosed. Defenders should continue to block trywand.cc at DNS and proxy layers, monitor for re‑registration or similar domains using the same registrar or Cloudflare IP range, and incorporate the observed indicators—such as the SSL issuer, nameserver pair, and the specific page title—into threat‑intel feeds.