winraft[.]com

Analysis of the domain winraft.com indicates it was operating as a crypto-gambling phishing site targeting users with a fraudulent online casino offering. The domain was registered on February 21, 2026, through MAT BAO CORPORATION and resolved to the IP address 69.5.189.54, hosted on AS42624 (Global-Data System IT Corporation) in Switzerland. Infrastructure analysis reveals the use of Nginx and OpenResty web technologies, with nameservers ns1.nameserverhub.com and ns2.nameserverhub.com. The SSL certificate was issued to 'Internet Widgits Pty Ltd,' a non-specific issuer commonly associated with low-reputation or disposable certificates. The page title, 'WINRAFT | Play at the best online casino based on Blockchain,' explicitly identifies the site as a blockchain-based gambling platform, aligning with the classified 'Crypto Scam' type.

Gridinsoft assigned a trust score of 1 out of 100, reflecting high suspicion. At the time of assessment, three out of 93 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was blocked by PhishDestroy. The phishing kit in use was identified as 'Gambler Scam,' though specific technical indicators from the kit, such as payload URLs or C2 infrastructure, are not currently available in the provided intelligence. As of July 25, 2026, the domain is reported offline, though defenders should treat it as a historical indicator of compromise.

Organizations are advised to update blocklists with the domain, IP, and associated nameservers. Given the low detection rate on VirusTotal, reliance on additional threat feeds is recommended for broader coverage. The exact content and functionality of the site remain unanalyzed, and no confirmation exists regarding user interaction data or successful compromises linked to this domain. Further monitoring of related infrastructure, particularly other domains using the same nameservers or IP range, is warranted.