hugwin[.]cc

This investigation documents the malicious infrastructure observed for the domain hugwin.cc, which was taken offline as of the report date (July 24, 2026). The site was registered through Global Domain Group LLC on April 12, 2026 and resolved to the Cloudflare‑owned address 172.67.143.73, located in the United States under ASN 13335. The authoritative nameservers are josephine.ns.cloudflare.com and miguel.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The TLS certificate presented is issued by Let’s Encrypt (identifier YE1), and the web server returned HTTP 403, indicating that access to the page was denied at the time of testing.

The page title retrieved prior to takedown read “Hugwin: Most Popular Online Crypto Casino Based on Blockchain,” which aligns with the declared scam type of brand impersonation. Malware analysis links the site to the publicly known “Gambler Scam” phishing kit, a toolkit commonly used to harvest credentials from users seeking cryptocurrency gambling services. Reputation services show a Gridinsoft trust score of 0 / 100, and VirusTotal recorded detections from 10 of 91 scanning engines, reinforcing the malicious classification. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

While the site is currently offline, the underlying hosting arrangement—Cloudflare’s shared IP—could be reused for future campaigns. Defenders should continue to block the domain and its associated IP, monitor for re‑registration, and add the observed nameserver pair to DNS‑based threat‑intelligence feeds. Additional scrutiny of any new assets that resolve to 172.67.143.73 is advised, as well as inclusion of the SSL fingerprint in TLS inspection rules. The limited public data prevents a full assessment of the phishing page’s content, so further sandbox analysis should be performed if the domain resurfaces.