stiwin[.]pro

The domain stiwin.pro was registered on 20 November 2025 through Web Commerce Communications Limited and is currently listed as offline. DNS resolution points to the IP address 172.67.160.163, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. The authoritative nameservers are braden.ns.cloudflare.com and emely.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was observed for the host, meaning HTTP connections would be unencrypted.

The site presented the page title “Stiwin: Most Popular Online Crypto Casino Based on Blockchain,” aligning with the recorded scam type of a crypto scam and the identified phishing kit labeled “Gambler Scam.” The domain has been blocked by the PhishDestroy blocklist and appears on a single external security blocklist. Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100). VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of fraudulent activity. While the title and kit suggest an attempt to lure victims into a counterfeit cryptocurrency gambling platform, no additional page content, credential‑capture forms, or malicious payloads have been captured, leaving the exact phishing mechanics uncertain.

Defenders should add stiwin.pro to network blocklists, enforce DNS sinkholing for the associated IP range, and monitor Cloudflare‑hosted traffic for re‑registration attempts. Updating intrusion‑detection signatures with the observed domain, IP, and nameserver patterns will help detect any resurgence. Continuous re‑scanning of the domain, especially if it returns online, is advised to capture any evolving payloads or credential‑harvesting pages.