rxwin[.]shop

The domain rxwin.shop is a phishing site engaged in brand impersonation and cryptocurrency scams. It falsely presents itself as an online casino under the guise of 'foundation' to deceive users into engaging with fraudulent cryptocurrency activities. As of the latest verification, rxwin.shop has been taken offline, but it previously posed an elevated risk to users by attempting to lure victims into crypto-related scams without employing a known drainer kit.

Technical analysis of rxwin.shop reveals limited detection by security vendors, with only 1 of 95 VirusTotal vendors flagging the domain. The site resolves to the IP address 172.67.142.206, hosted on Cloudflare's infrastructure (AS13335) in the US, and appears on 1 security blocklist (PhishDestroy). The domain lacks an SSL certificate, and its nameservers are dylan.ns.cloudflare.com and lucy.ns.cloudflare.com. The observed page title, 'RXWIN | Play at the best online casino based on Blockchain,' aligns with its cryptocurrency scam theme. Gridinsoft assigns rxwin.shop a trust score of 0/100, further indicating its malicious nature.

Users who interacted with rxwin.shop should take immediate steps to secure their assets. Since this is a cryptocurrency scam, revoke any token approvals granted to unknown or suspicious contracts and transfer funds to a new, secure wallet. Monitor accounts for unauthorized transactions and report the domain to relevant platforms, such as Google Safe Browsing, PhishTank, or local cybercrime authorities. If credentials were entered on the site, change passwords immediately and enable two-factor authentication (2FA) on all affected accounts to prevent further fraud.