cestwin[.]com

cestwin.com entered the PhishDestroy evidence set on Jun 15, 2026. The stored content classification is generic phishing. The assembled evidence scores 100/100 (critical).

Four independent sources are positive: VirusTotal, MetaMask, SEAL, and Spamhaus DBL. VirusTotal recorded 18 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Certego, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, SOCRadar, Sophos, VIPRE on Jul 27, 2026 at 03:29 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 14:37 UTC. The evidence is not unanimous. AlienVault OTX listed 1 community pulse reference (not vendor detections) on May 10, 2026 at 17:10 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on May 11, 2026 at 05:00 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 10:10 UTC. Registration records for the domain list Fewmoretaps OU d/b/a Trustname.com as the registrar and May 10, 2026 as the creation date. At collection time, the hostname resolved to 172.67.220.72 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cast-sec. Captured page title: “Cestwin: Most Popular Online Crypto Casino Based on Blockchain”. TLS metadata lists Let's Encrypt / E7 as the certificate issuer with validity through Aug 6, 2026; checked May 10, 2026 at 17:00 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as generic phishing.