ddadycwin[.]space

The domain ddadycwin.space was registered on October 10, 2025 through Atak Domain and resolves to the Cloudflare edge address 172.67.220.37, located in the United States under ASN 13335 (Cloudflare, Inc.). The site is served without an SSL certificate, indicating HTTP-only delivery, and its DNS is hosted on eugene.ns.cloudflare.com and faye.ns.cloudflare.com. According to the page title captured before takedown, the site presented itself as “Daddy Casino — Играй только в лучшие игры! Рекордные выигрыши вместе с нами!”, which aligns with the observed scam type of Crypto Gambling.

The domain is associated with the Gambler Scam phishing kit and has been blocked by the PhishDestroy feed, appearing on one external security blocklist. A Gridinsoft trust score of 0 / 100 further reflects the malicious reputation. VirusTotal analysis flagged the domain on two of ninety‑five scanners, confirming that at least a subset of security vendors consider the site malicious.

Current status is offline, so active content cannot be inspected, but the historical evidence demonstrates a clear intent to lure victims into a fake casino environment that likely solicits cryptocurrency deposits. Defenders should continue to block ddadycwin.space at the DNS and network perimeter, monitor the associated Cloudflare IP range for any re‑hosting attempts, and update web‑filter and endpoint policies to include the identified phishing kit signature. Ongoing vigilance is advised because the underlying infrastructure (Cloudflare) can be reused for future campaigns, and the lack of SSL may change if the operators obtain a certificate later.