spinwin[.]cash

On July 22, 2026, the domain spinwin.cash was observed hosting a crypto‑related scam that impersonates the foundation brand. The site was flagged by PhishDestroy and is currently taken offline, returning no HTTP response. DNS resolution points the domain to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are elmo.ns.cloudflare.com and jasmine.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure.

No SSL certificate was presented, indicating the site was served over plain HTTP. VirusTotal analysis recorded a single detection out of 93 security vendors, suggesting limited but notable vendor awareness of malicious activity. The page title retrieved before takedown read "SPINWIN | Play at the best online casino based on Blockchain," aligning with the reported "Gambler Scam" kit and the broader classification of a crypto scam. The domain appears on one public security blocklist, reinforcing its reputation as malicious.

While the exact content of the pages is not presently verifiable due to the offline status, the combination of brand impersonation, gambling‑oriented messaging, and blockchain references provides strong evidence of a targeted fraud campaign. Defenders should block spinwin.cash at the network perimeter, monitor the associated Cloudflare IP for any resurgence of malicious activity, and update endpoint and email security policies to flag any communications referencing the foundation brand that reference blockchain or casino terminology. Ongoing surveillance of Cloudflare‑hosted IP ranges is advised, as the infrastructure may be reused for future campaigns.