win-slots[.]world

win-slots.world was observed hosting a crypto‑scam landing page titled “WIN‑SLOTS | Play at the best online casino based on Blockchain”. The site resolved to the IPv4 address 69.5.189.54, which is allocated to AS42624 (Global‑Data System IT Corporation) and geolocated to Switzerland (CH). The domain is registered through SC‑GLOBAL‑DATA‑20040120, and its authoritative name servers are ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, and ns4.nameserver. The TLS certificate presented for the site is issued to Internet Widgits Pty Ltd. VirusTotal analysis recorded 8 detections out of 95 scanned engines, indicating a moderate level of malicious labeling.

The domain appears on a single security blocklist and is specifically blocked by PhishDestroy. Malware analysis attributes the site to the Gambler Scam phishing kit, a known template used to lure victims into cryptocurrency‑based gambling fraud. As of the report date (24 July 2026) the host is taken offline, but the infrastructure details remain active and could be reused.

Uncertainty remains regarding the current hosting provider and whether additional IPs are associated with the campaign. Defenders should continue to monitor the IP 69.5.189.54 and related ASN for new activity, enforce blocklisting of the domain and its name servers, and consider adding the certificate fingerprint to TLS inspection rules. Incident response teams should treat any communications referencing win‑slots.world as malicious and advise users to avoid interacting with the site or any URLs derived from it.