mellstroywin[.]casino

The domain mellstroywin.casino was observed hosting a crypto gambling page titled "Mellstroy Casino — Играй и Выигрывай с Mellstroy Онлайн" and was identified as a brand impersonation campaign targeting Telegram users. Infrastructure analysis shows the domain is registered through Cloudflare, Inc. and resolves to the IP address 172.67.203.115, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The authoritative nameservers are arturo.ns.cloudflare.com and jill.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. No SSL certificate was detected for the domain, suggesting that HTTPS was not enforced at the time of observation.

The site was flagged by one security blocklist and is currently listed as offline. VirusTotal recorded a single positive detection out of 95 scanned security vendors, and the domain is explicitly blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

The phishing kit in use is classified as a "Gambler Scam," consistent with the crypto gambling narrative in the page title. Defenders should update their URL filtering and threat intelligence feeds to include mellstroywin.casino, enforce blocklisting of the associated IP 172.67.203.115, and monitor for any re‑hosting attempts that may leverage the same Cloudflare infrastructure. Continuous monitoring of Cloudflare‑registered domains targeting Telegram and crypto gambling themes is recommended to detect future iterations of this campaign.