50spin[.]us

Analysis of the domain 50spin.us, observed as offline on July 23, 2026, indicates that it was used for a crypto‑focused gambling phishing campaign. The site was registered on February 21, 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED and resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was presented, confirming that the service operated over plain HTTP. The authoritative nameservers are drew.ns.cloudflare.com and zariyah.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure.

Reputation services rate the domain extremely poorly: Scamadviser assigns a trust score of 1 / 100 and Gridinsoft a score of 0 / 100. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal reports that 15 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of abuse. AlienVault’s Open Threat Exchange recorded the domain in one threat‑intel pulse.

The page title retrieved during the brief capture, “50spin: Most Popular Online Crypto Casino Based on Blockchain,” together with the classification of the underlying kit as “Gambler Scam,” and the declared scam type “Crypto Scam,” point to a credential‑harvesting operation targeting cryptocurrency users who are attracted to online casino promises. Defenders should add the domain and its associated IP address to outbound and inbound filtering rules, enforce HTTPS‑only policies to prevent accidental connections to unsecured hosts, and monitor for any resurgence of the same IP range or similar Cloudflare‑hosted infrastructure. Because the site is currently taken offline, any active traffic is likely residual or from cached references. Continuous threat‑intel feeds should be consulted for further indicators of compromise, especially any emerging patterns that reuse the same phishing kit or target the same cryptocurrency‑related audience.