1winmx[.]org

The domain 1winmx.org was created on March 11, 2026 and is currently active. It is classified as a high‑risk generic phishing site that specifically targets users interested in online gambling. The page title “1win‑1win México: El mejor Casino Online y Apuestas con Aviator” confirms that the site masquerades as a legitimate Mexican casino platform.

Technical analysis shows that 1winmx.org resolves to the IP address 104.21.36.68, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site is served over HTTPS using a Let’s Encrypt certificate (E8). Registration was performed through Dynadot LLC, and the authoritative nameservers are treasure.ns.cloudflare.com and vicky.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS and CDN services.

The infrastructure matches the known “Gambler Scam” phishing kit, and the domain appears on at least one public security blocklist. AlienVault OTX references include 23 threat‑intelligence pulses that cite the same domain or associated indicators. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports a single detection out of 95 scanned vendors, reinforcing the malicious nature despite the low detection count. PhishDestroy has also listed the domain as blocked.

Defenders should add 1winmx.org to network and email filtering rules, and consider blocking the associated Cloudflare IP range if broader mitigation is required. Continuous monitoring of newly registered domains that use similar naming patterns or the same registration registrar is advised. Threat‑intel teams should enrich future alerts with the observed indicators—domain, IP, certificate fingerprint, and nameserver set—to improve detection of related gambling‑focused phishing campaigns.