winrado[.]com

winrado.com was observed hosting a fraudulent cryptocurrency casino front‑end that advertises itself as “Winrado: Most Popular Online Crypto Casino Based on Blockchain”. The site was registered on 14 December 2025 through MAT BAO CORPORATION and resolves to 188.114.97.3, an address owned by AS13335 (Cloudflare, Inc.) located in the United States. The domain uses Cloudflare’s DNS service (brett.ns.cloudflare.com, edna.ns.cloudflare.com) but does not present an SSL/TLS certificate, leaving the connection unencrypted. Gridinsoft assigns a trust score of 0 / 100, indicating a lack of credibility.

Automated analysis by VirusTotal shows that 15 of 93 security engines flagged the domain as malicious, consistent with its classification as a crypto‑scam using the publicly known “Gambler Scam” phishing kit. The domain has been added to at least one security blocklist and was actively blocked by the PhishDestroy sink‑hole service before being taken offline. Current status is offline, but the underlying IP remains under Cloudflare control and could be reused for future campaigns. Defenders should continue to block winrado.com at DNS and proxy layers, monitor the 188.114.97.3 address for any resurgence, and add the IP and associated nameservers to threat‑intel feeds.

Because the site lacked TLS, any attempted connections would have been vulnerable to interception, further underscoring the need for strict outbound filtering of crypto‑related URLs. Attribution to the “Gambler Scam” kit suggests that threat actors may reuse the same malicious assets across multiple campaigns, so related indicators such as the kit’s JavaScript files and the Cloudflare nameserver pattern should be incorporated into detection rules. Ongoing vigilance is recommended, as the domain’s recent creation date (December 2025) indicates a short‑lived infrastructure that can be rapidly redeployed.