greenwin[.]pro

Analysis of the domain greenwin.pro indicates it is an active phishing site targeting users of cryptocurrency-based gambling platforms. Registered on April 4, 2026, through Dynadot Inc, the domain currently resolves to the IP address 104.21.20.41, which is geolocated to Canada and associated with Cloudflare, Inc. infrastructure. The domain's nameservers, imani.ns.cloudflare.com and lynn.ns.cloudflare.com, further confirm its reliance on Cloudflare services, a common tactic to obscure hosting origins and evade takedowns. The page title, 'Greenwin: Most Popular Online Crypto Casino Based on Blockchain,' explicitly identifies the site's purported function, aligning with the 'Gambler Scam' phishing kit classification. As of July 12, 2026, the domain remains operational, returning an HTTP 200 status code, and has been flagged by one security blocklist. Detection engines on VirusTotal report 16 of 94 vendors marking the domain as malicious, though the specific nature of these detections—whether related to phishing, malware distribution, or other threats—remains unverified. The domain's Gridinsoft trust score of 0/100 corroborates its high-risk classification. Infrastructure analysis reveals the use of a Google Trust Services SSL certificate (WE1), which provides a veneer of legitimacy but does not mitigate the underlying threat. The domain's registration age (approximately three months at the time of analysis) suggests it may be part of a broader campaign, though no direct links to other domains or threat actors have been confirmed in the available data. Defenders are advised to block the domain at the DNS or network level, monitor for associated IP addresses, and alert users to the risks of interacting with unregulated cryptocurrency gambling platforms. Further investigation into the phishing kit's distribution methods and potential secondary payloads is recommended.