winmaker[.]co[.]com

winmaker.co.com is an active domain observed on July 24, 2026 that serves a fraudulent site targeting users of the Ankr ecosystem. The site returns HTTP 200 and presents a page title “Winmaker Casino Australia – Licensed Casino Games”, suggesting a crypto‑ gambling front‑end. Infrastructure analysis shows the domain resolves to IP 45.94.158.128, which belongs to ASN 56851 in Ukraine. The host is protected by Cloudflare and presents an SSL certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake despite the malicious intent. The domain is registered through Moniker Online Services LLC and was originally created on August 16 1997, a legacy registration that predates the current abuse.

Nameservers ns1‑ns4.nic.co.com are in use, consistent with the parent “co.com” namespace. Automated scans reveal the site runs WordPress with MySQL, PHP, Yoast SEO, Swiper, and jQuery libraries, a stack commonly repurposed by the Gambler Scam phishing kit, which is identified in the intelligence as the toolkit employed. The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple mitigation services have already flagged it. VirusTotal reports two of ninety‑one security vendors flagging the host, reinforcing the suspicion.

The Gridinsoft trust score is 0 / 100, indicating an extremely low reputation. While the page content has not been independently inspected, the combination of a brand‑impersonation label (Ankr), a crypto‑gambling narrative, and the presence of a known gambling phishing kit provides strong evidence of a high‑risk operation. Defenders should add 45.94.158.128 to network block lists, enforce DNS filtering for winmaker.co.com, and monitor for related command‑and‑control traffic. Continued observation of the hosting provider and rapid takedown requests to the registrar are recommended to disrupt the campaign.