play[.]spookwin[.]com

This domain, play.spookwin.com, is actively flagged as a high-risk gambling-themed scam targeting cryptocurrency users. Analysis indicates the site presents itself as an online crypto casino, as stated in its page title: 'Spookwin: Most Popular Online Crypto Casino Based on Blockchain.' The domain was registered on May 9, 2026, through Fewmoretaps OU operating under Trustname.com, a registrar frequently associated with newly created fraudulent sites. Infrastructure analysis reveals the domain resolves to 188.114.96.3, hosted under Cloudflare's network (AS13335), a common tactic to obscure origin and evade takedowns. The site employs Cloudflare nameservers (charles.ns.cloudflare.com and faye.ns.cloudflare.com) and uses a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. Security vendors have detected malicious activity, with 13 of 91 engines on VirusTotal flagging the domain. It is also blocked by PhishDestroy and appears on at least one security blocklist. The domain is associated with the 'Gambler Scam' phishing kit, which typically deploys fake gambling platforms to harvest credentials or misappropriate cryptocurrency deposits. Gridinsoft assigns a trust score of 1 out of 100, further indicating high risk. Defenders should treat this domain as confirmed malicious infrastructure. Immediate actions include blocking the domain and IP at network perimeters, monitoring for internal connections, and alerting users about cryptocurrency-related scams. The exact content and functionality of the site have not been manually analysed, but the combination of infrastructure, detection data, and known phishing kit association provides sufficient evidence for classification as active fraud.