xaawin[.]com

This domain, xaawin.com, is identified as a brand impersonation threat targeting Base, a legitimate blockchain platform. The site masquerades as a cryptocurrency casino under the guise of "Xaawin: Most Popular Online Crypto Casino Based on Blockchain," leveraging the reputation of Base to deceive users into engaging with fraudulent gambling services. Analysis indicates the domain is currently offline, but prior activity suggests malicious intent through social engineering and potential financial exploitation. Infrastructure analysis reveals the domain was registered on June 04, 2026, through Fewmoretaps OÜ d/b/a Trustname.com, a registrar with a history of hosting suspicious domains. It resolves to the IP address 104.21.17.117 and employs Cloudflare for traffic obfuscation, alongside tracking technologies such as Twitter Ads and Facebook Pixel to monitor user interactions. Security vendors flagged xaawin.com in 13 of 95 VirusTotal scans, while Gridinsoft assigned it a trust score of 0/100. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the underlying malicious intent. The current status of xaawin.com is offline, but the technical indicators suggest a high likelihood of re-emergence under a similar or altered infrastructure. Organizations and users are advised to block the domain and its associated IP (104.21.17.117) at the network level. Security teams should monitor for domains registered through Fewmoretaps OÜ or utilizing identical tracking technologies (Twitter Ads, Facebook Pixel) for potential follow-up threats. Users should be educated on recognizing brand impersonation tactics, particularly in the cryptocurrency and blockchain sectors, where financial risks are elevated. If encountered, reports should be submitted to relevant threat intelligence platforms to aid in broader detection efforts.