1-win[.]vin

Analysis of the domain 1-win.vin, observed on July 23, 2026, indicates a confirmed phishing operation that masquerades as a cryptocurrency casino linked to Elon Musk. The site was created on February 02, 2026 and is registered through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.156.183, which belongs to AS13335 Cloudflare, Inc. and is geographically located in the United States. DNS resolution is served by the Cloudflare nameservers adrian.ns.cloudflare.com and langston.ns.cloudflare.com.

No TLS certificate was detected, meaning the site operates without HTTPS protection. The page title returned by the server reads "1-win: Elon Musk’s Official Crypto Casino Powered by Blockchain," confirming the use of a high‑profile brand name to lure victims. The infrastructure is classified as a crypto‑related scam; the phishing kit in use has been identified as the "Gambler Scam" package. Detection metrics show that 15 of 95 security vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist maintained by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious nature of the host. The site is currently offline, but its prior activity suggests a brief window of operation aimed at harvesting credentials or cryptocurrency payments. Defenders should add 1-win.vin and its resolving IP 172.67.156.183 to blocklists, monitor Cloudflare‑hosted traffic for similar patterns, and enforce strict URL filtering for any references to the advertised crypto casino. Continuous observation of the registrar NiceNIC for new domains using the same naming convention is advised, as threat actors often recycle similar identifiers.