degowin[.]com

On July 24, 2026, the domain degowin.com was observed to host a fraudulent cryptocurrency casino front. The site presented the page title “Degowin: Most Popular Online Crypto Casino Based on Blockchain,” which aligns with the classified scam type of a crypto scam employing the Gambler Scam phishing kit. The domain was registered on September 2, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 172.67.194.207, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented for the domain is identified as “WE1,” indicating a valid‑looking SSL configuration that may be used to lend credibility to the malicious page.

Reputation services show extremely low trust scores: Scamadviser rates the domain 1 out of 100, while Gridinsoft assigns a score of 0 out of 100, reflecting a consensus of malicious intent. VirusTotal analysis recorded detections from two of ninety‑five scanning engines, reinforcing the suspicion of malicious activity. The domain is currently listed on one security blocklist and has been actively blocked by the PhishDestroy mitigation service. The site’s operational status is reported as offline at the time of analysis.

Evidence is limited to the metadata described above; no direct examination of page content, login forms, or credential‑harvesting mechanisms has been performed. Consequently, the precise tactics used to lure victims remain uncertain, although the association with a crypto‑casino narrative suggests attempts to solicit deposits or wallet addresses. Defenders should add degowin.com to network and endpoint blocklists, monitor DNS queries for the 172.67.194.207 address, and enforce TLS inspection to detect any future re‑hosting attempts. Continuous re‑scanning with VirusTotal and other multi‑engine scanners is recommended to capture any changes in the threat landscape.