pay-play[.]win

The domain pay-play.win was registered on February 21, 2026 through NameSilo, LLC and is currently resolved to the Cloudflare‑provided address 172.67.215.221, which maps to an AS13335 Cloudflare, Inc. presence in the United States. DNS resolution is served by the authoritative name servers sureena.ns.cloudflare.com and robert.ns.cloudflare.com. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 intermediate, indicating that TLS termination is performed by Cloudflare. An HTTP GET request returns a 200 OK status, and the page title reported by the crawler is "Pay-play: Most Popular Online Crypto Casino Based on Blockchain," confirming that the site advertises a cryptocurrency casino service. Technical fingerprinting reveals the use of Cloudflare Browser Insights and generic Cloudflare services, consistent with the hosting provider.

Security telemetry shows the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis reports that 16 of 95 scanned security vendors flag the domain, indicating a significant detection consensus. The site is identified as employing the "Gambler Scam" phishing kit, which is commonly used to lure victims into fraudulent cryptocurrency gambling schemes. The overall risk assessment is high, and the domain remains active as of the report date, July 23, 2026.

Defenders should add pay-play.win to URL filtering and DNS blocklists, enforce TLS inspection to capture any credential submissions, and monitor outbound connections to the associated Cloudflare IP range for anomalous traffic. Continuous re‑evaluation is advised, as the hosting infrastructure can be repointed behind Cloudflare’s network with minimal notice.