winblast[.]bet

This domain, winblast.bet, is actively engaged in brand impersonation targeting the Blast blockchain platform, as indicated by its page title and confirmed threat intelligence. Registered on February 6, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to the IP address 188.114.96.3 and is hosted on infrastructure utilizing Nginx and OpenResty technologies. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains, providing no definitive indication of intent on its own. However, the domain has been flagged in 25 threat intelligence pulses on a major open-source threat exchange platform, reinforcing its classification as malicious. Analysis indicates the domain is part of a Gambler Scam phishing kit, which typically aims to deceive users into engaging with fraudulent online gambling platforms. The domain currently holds a trust score of 1 out of 100, a metric that reflects its low reputation based on historical abuse patterns. It appears on two security blocklists and is blocked by at least two security vendors, further corroborating its malicious status. Only one out of 95 security vendors on a widely used malware analysis platform currently flags the domain, suggesting that detection may still be limited or evolving. The exact content and functionality of the site remain unconfirmed, as no direct analysis of the web pages has been conducted. However, the page title explicitly references a blockchain-based online casino, aligning with the Gambler Scam classification. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Monitoring for related domains registered through the same registrar or resolving to the same IP address may help identify additional threats in this campaign. Given its active status as of July 12, 2026, continued vigilance is recommended to prevent user exposure to this impersonation scam.