Dozens of Crypto Casinos Flagged by MalwareTips Share Registrars, Servers and Page Code, Records Show

Published Nov. 3, 2026. This is an ongoing investigation. The technical findings are as of our records check on Oct. 24, 2026; sites may have changed or gone offline since, and we will update this page as new details come out.

The pitch is always the same. A promo code shows up in a social-media clip or a group chat. It unlocks a bonus worth thousands of dollars at a slick-looking crypto casino. Then, at the first withdrawal, the site asks for a fresh crypto deposit to "verify" the account, and every payment leads to another demand, according to the security site MalwareTips [1].

Since Oct. 20, 2026, our team has filed reports on dozens of these sites that MalwareTips flagged, including several that borrow the names of real gambling brands: drafrkings.com, drattkings.com and draftkinfs.com (DraftKings), chumbacassino.com and chumbacasinoo.com (Chumba Casino), zulacsino.com and zulaasino.com (Zula Casino), and mgmcasinos.cc (MGM). We found nothing linking the real brands to these sites.

We wanted to know what, if anything, these sites have in common. So on Oct. 24 we checked 30 of the domains against public records: domain registration data (RDAP), DNS, hosting networks, security certificates and the code each homepage serves. We did not sign up or deposit anywhere.

What we can and can't say: The records below are technical observations: many of these sites were registered in batches, share servers or serve the same page code. That is consistent with shared tooling. It does not show who runs the sites, or whether one person or group runs more than one of them. We are not naming any person or company, and none has been charged in connection with these sites in any source we found.

What the records show

1. Ten brand lookalikes registered within 13 minutes, plus an MGM lookalike with the same page code

Registration records show 10 domains were registered through the same registrar, NiceNIC International Group, on Oct. 17, 2026, between 1:36 a.m. and 1:49 a.m. ET [2]:

Domain	Imitates	Registered (ET, Oct. 17)
drafrkings.com	DraftKings	1:36 a.m.
drattkings.com	DraftKings	1:36 a.m.
draftkinfs.com	DraftKings	1:36 a.m.
chumbacassino.com	Chumba Casino	1:36 a.m.
chumbacasinoo.com	Chumba Casino	1:36 a.m.
high5casin.com	High 5 Casino	1:37 a.m.
zulacsino.com	Zula Casino	1:37 a.m.
zulaasino.com	Zula Casino	1:37 a.m.
high5casion.com, high5casnio.com	High 5 Casino	1:49 a.m.

All 10 use Cloudflare. Eight share the same pair of Cloudflare nameservers, and the other two High 5 lookalikes share a second pair with mgmcasinos.cc, which was registered separately through Porkbun on Oct. 11. Cloudflare assigns nameserver pairs per account, but many unrelated accounts can get the same pair, so this alone does not prove one account.

The page code is a stronger link. When we downloaded all 11 homepages and swapped out each site's own name, the code was the same length on every site and identical apart from two randomly generated per-visit ID values. Each page includes a promo-code field and a "verification" panel.

2. Five "-win" casinos on one server

kegwin.com, ruzowin.com, fohawin.com, padowin.com and babowin.com were registered between Oct. 20 and Oct. 21, 2026, through three different registrars. All five point to the same IP address, 172.86.88.161, on a network run by RouterHosting LLC, and all use DNSPod nameservers [2]. Four of them served us the same set of 22 identically named code files (padowin.com timed out). MalwareTips published separate posts on fohawin.com [3] and babowin.com [6] on Oct. 23, 2026, each describing the site as a fake crypto casino run on a scam kit. Our report on that batch records a padowin.com post as well.

3. Nine sites hide behind the same unusual gate page

When we visited gabowex.com, kazimer777.xyz, guesex.com, lidamex.com, cubewex.com, otavao.com, vezawin.com, nezwin.com and first-one.world, each returned the same 5,103-byte page of scrambled JavaScript with an HTTP status code of 666. That code is not a standard web status. The pages were byte-for-byte identical across all nine, which points to shared code or tooling, not to a shared owner. Two of them, nezwin.com and first-one.world, also share a server (66.198.225.39) and nameservers [2]. MalwareTips separately says vezawin.com is built from the same kit as passionbox.top, guesex.com, raywin.online and kazimer777.xyz [4].

4. Two more sites share one app build

stacksmashx.com and velionroll.com both redirected us to the same login path and loaded the same uniquely named code files. They were registered months apart, on July 27 and Oct. 19, 2026, through different registrars [2].

What didn't link up

• Security certificates: every site uses its own free, automatically issued certificate, so certificates did not tie any sites together.
• sdlox.com runs its own build, which bills itself as "Donald Trump's Leading Blockchain Crypto Casino." We found no infrastructure link to the clusters above. There is no evidence Donald Trump has any connection to it.
• raywin.online resolved to a domain-parking network and would not load when we checked, so its current status is unconfirmed.
• zenawin.com now shows a Cloudflare "Suspected Phishing" warning instead of the casino.

The money trail: status pending

The deposit wallet addresses are where this kit actually takes people's money. They are not in the public page code. They appear only after someone signs up and tries to withdraw, and we did not sign up. We have not yet documented any wallet address for these sites, and we are not reporting any shared payment rails until we can. If you have a screenshot of a deposit address from one of these sites, please blur your personal details and send it to us.

How the scam works, according to MalwareTips

MalwareTips describes the same six-step funnel in its reports on these sites [1][3][4]:

1. A promo code is pushed through TikTok, YouTube, Facebook, Instagram, Discord or Telegram, often with fake celebrity backing.
2. Sign-up takes seconds, with no identity check.
3. The code credits a large bonus, often $2,000 to $10,000, and the games run smoothly.
4. A withdrawal request hits a wall: "verification required" or "minimum deposit required."
5. The site asks for a crypto "verification deposit," commonly $100 to $500.
6. More demands follow (a higher "verification tier," a VIP upgrade, a "tax" on winnings or a bigger deposit) until support stops replying.

Red flags

• You have to pay to withdraw. A real fee would come out of your winnings, not require a new deposit.
• A huge no-strings bonus for entering a code from a video or chat.
• A misspelled big-brand name, such as "drafrkings" or "chumbacassino."
• Crypto-only payments and no named, licensed operator.
• Live "wins" feeds that repeat the same names and amounts.

What to do if you're targeted

1. Don't send anything more. Another "verification" payment will not release your balance.
2. Save evidence: screenshots, the promo code, deposit wallet addresses and transaction hashes.
3. Tell the exchange you sent from, giving it the receiving address and transaction hash.
4. Report it to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov.
5. Ignore "recovery" services that charge upfront. They are often a second scam.

Domains in this investigation (as of Oct. 24, 2026)

Group	Domains	Link we documented
A: NiceNIC batch	drafrkings.com, drattkings.com, draftkinfs.com, chumbacassino.com, chumbacasinoo.com, zulacsino.com, zulaasino.com, high5casin.com, high5casion.com, high5casnio.com, mgmcasinos.cc	Same registration window (except mgmcasinos.cc), same Cloudflare nameserver pairs, same page code apart from the site name and per-visit IDs
B: shared server	kegwin.com, ruzowin.com, fohawin.com, padowin.com, babowin.com	Same IP and DNSPod nameservers; identical code files (4 of 5 checked)
C: "666" gate	gabowex.com, kazimer777.xyz, guesex.com, lidamex.com, cubewex.com, otavao.com, vezawin.com, nezwin.com, first-one.world	Byte-identical gate page; nezwin and first-one.world share an IP
D: shared build	stacksmashx.com, velionroll.com	Identical code files
Unlinked	sdlox.com, raywin.online, zenawin.com	No infrastructure link documented yet

These are technical observations from public records. They do not identify who operates any of these sites, and links between the groups are unconfirmed. Next steps: deposit wallet addresses, and checks for new domains on the same servers and nameservers.

Sources

1. MalwareTips, "Kegwin.com EXPOSED – Casino Scam or Legit? What We Found," Oct. 24, 2026. https://malwaretips.com/blogs/kegwin-com-exposed-casino-scam-or-legit-what-we-found/
2. Scammers.com records check, Oct. 24, 2026: public RDAP registration records (via rdap.org), DNS lookups (Google Public DNS), IP network data (ipinfo.io), TLS certificates and homepage HTML collected from each domain. Raw data on file.
3. MalwareTips, "Fohawin.com EXPOSED – Fake Casino or Legit? What We Found," Oct. 23, 2026. https://malwaretips.com/blogs/fohawin-com-exposed-fake-casino-or-legit-what-we-found/
4. MalwareTips, "Vezawin.com EXPOSED – Real Casino or Scam? What to Know," Oct. 23, 2026. https://malwaretips.com/blogs/vezawin-com-exposed-real-casino-or-scam-what-to-know/
5. MalwareTips reports on the individual domains, Oct. 2026, including drafrkings.com, chumbacassino.com, zulacsino.com, high5casin.com, mgmcasinos.cc and nezwin.com.
6. MalwareTips, "Babowin.com EXPOSED - Fake Casino or Legit? What We Found," Oct. 23, 2026. https://malwaretips.com/blogs/babowin-com-exposed-fake-casino-or-legit-what-we-found/

---

Corrections and updates: If you are named in this article, or represent someone who is, and believe anything here is inaccurate or out of date, please contact us at editorandchief@scammers.com. We will review it and update the article promptly.