centwin[.]top

Analysis as of July 23 2026 indicates that centwin.top is an active crypto‑scam phishing infrastructure. The domain, registered on February 21 2026 through Global Domain Group LLC, resolves to the IP address 188.114.96.3, which belongs to Cloudflare (AS13335) and is geolocated in the United States. The host presents no SSL certificate, and its DNS configuration uses the Cloudflare authoritative servers glen.ns.cloudflare.com and ryleigh.ns.cloudflare.com. The page title returned from the site – “Centwin: Most Popular Online Crypto Casino Based on Blockchain” – aligns with the listed scam type “Crypto Scam” and the identified phishing kit “Gambler Scam”.

The site has been flagged by PhishDestroy and is currently taken offline, but it remains listed on one external security blocklist. VirusTotal analysis shows that 12 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of fraudulent activity. Gridinsoft assigns a trust score of zero out of one hundred, indicating a complete lack of reputation. Although the site is offline at the time of this report, the underlying IP address and hosting provider remain active, allowing adversaries to redeploy similar payloads or clone the phishing kit.

Defenders should immediately block centwin.top and its resolved IP 188.114.96.3 at network perimeters, update internal threat intel feeds with the domain’s registration and hosting details, and monitor Cloudflare‑hosted assets for reappearance. Continuous re‑scanning of the domain on VirusTotal and similar sandboxes is advised to capture any changes in detection ratios. The limited visibility of the site’s content prevents full characterization of its malicious behavior, so threat‑hunting teams should look for related indicators such as the Gambler Scam kit signatures, traffic to the identified nameservers, and any anomalies targeting cryptocurrency‑related services.