go[.]rackswin[.]com

This domain, go.rackswin.com, is assessed as an elevated-risk brand impersonation threat specifically targeting crypto casino and gambling platforms. Analysis of the page title, "Rackswin: Most Popular Online Crypto Casino Based on Blockchain," confirms the intent to mimic legitimate blockchain-based gambling services, likely to deceive users into disclosing sensitive financial information or depositing cryptocurrency under false pretenses. The threat type aligns with fraudulent schemes designed to exploit trust in established gambling brands, particularly those operating in the cryptocurrency sector. Infrastructure analysis reveals multiple technical indicators supporting the elevated risk assessment. The domain is flagged by 15 out of 95 security vendors on VirusTotal, indicating broad consensus among threat intelligence providers regarding its malicious nature. It appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, further validating its fraudulent classification. The domain was registered through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.66.237, which is hosted behind Cloudflare, a common tactic to obscure the true origin and evade detection. The SSL certificate is issued by Let’s Encrypt, a legitimate but often abused certificate authority that provides free encryption to malicious actors. Additional technologies detected include Cloudflare Browser Insights and HTTP/3, which may be leveraged to enhance the site’s perceived legitimacy or track user interactions. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as a high-risk entity. To mitigate risks associated with this brand impersonation threat, users and organizations should implement the following measures. First, block the domain and its resolving IP address (104.21.66.237) at the network level to prevent access from corporate or personal devices. Second, monitor for any attempts to register similar domains using variations of the brand name "Rackswin" or other crypto gambling-related keywords, as these may indicate follow-up campaigns. Third, educate users about the risks of interacting with unsolicited gambling or crypto-related offers, particularly those promising high returns or exclusive bonuses. Fourth, verify the legitimacy of any gambling platform by cross-referencing its domain registration details, SSL certificate transparency logs, and user reviews from trusted sources. Finally, report the domain to relevant threat intelligence platforms to contribute to broader detection and takedown efforts. Given the domain’s current offline status, continuous monitoring is advised to detect any resurgence or rebranding attempts.