wingcas[.]com

wingcas.com was registered on June 2, 2025 through Web Commerce Communications Limited. The site presented the title “WINGCAS | Play at the best online casino based on Blockchain,” indicating a crypto‑focused gambling lure. Infrastructure analysis shows the domain resolves to IP 69.5.189.54, which belongs to AS42624 (Global‑Data System IT Corporation) and is geolocated to Switzerland. No TLS certificate is deployed, leaving the HTTP service unencrypted. The authoritative nameservers are ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, and ns4.nameserverhub.com, a pattern often observed in disposable hosting used for malicious campaigns.

Static scanning on VirusTotal recorded detections from 2 of 95 antivirus engines, confirming malicious behavior. Gridinsoft assigned a trust score of 0 / 100, and the domain is listed on at least one external blocklist, with PhishDestroy confirming the site as offline. The observed malicious payload matches the “Gambler Scam” kit, a known template that harvests cryptocurrency credentials and redirects victims to fraudulent gambling pages. The combination of a crypto‑scam narrative, lack of encryption, and low trust scores aligns with the classification of a crypto gambling phishing operation.

Uncertainty remains regarding the current activity of the hosting IP, as the domain has been taken offline and no live HTTP response was captured. Additionally, the exact victim‑targeted brands are not disclosed beyond the generic casino theme. Defenders should immediately block wingcas.com and its resolving IP address at network perimeter devices, add the associated nameservers to sink‑hole lists, and monitor for re‑registration or similar domains using the same registrar. Continuous VT and blocklist feeds should be consulted for any resurgence, and threat‑intel teams should flag the Gambler Scam kit indicators for correlation with other incidents.