playdarw[.]com

The domain playdarw.com was observed to host a brand‑impersonation campaign targeting the foundation brand. The site is currently offline, but historical evidence shows it resolved to the Cloudflare‑owned address 188.114.97.3, located in the United States (AS13335). Registration data indicates the domain was created on 15 March 2025 through NameCheap, Inc., and it uses four Flokinet nameservers (ns1‑ns4.flokinet.net). No TLS certificate was present, meaning traffic was served over plain HTTP.

The page title retrieved from the live site read “WINJOM | Play at the best online casino based on Blockchain,” which aligns with the listed phishing kit “Gambler Scam” and the classification of the operation as a crypto‑related scam. Reputation scoring is extremely low, with a Gridinsoft trust score of 1 / 100, and the domain has been listed on at least one security blocklist and flagged by PhishDestroy. Threat intelligence sources corroborate the activity: AlienVault OTX includes the domain in one pulse, and VirusTotal reports that six of ninety‑five scanners flagged it as malicious.

The combination of a brand‑targeted lure, a gambling‑themed page title, and a low‑trust score suggests an attempt to lure foundation supporters into a cryptocurrency‑driven fraud scheme. Because the domain is already taken offline, immediate mitigation is limited to updating blocklists and ensuring that security products ingest the existing indicators. Defenders should add the IP address 188.114.97.3, the full list of nameservers, and the page title string to their detection rules, monitor for any re‑registration attempts, and continue to reference the associated OTX pulse and VirusTotal detections for correlation with future incidents.