Is casinoluckyhashscratch.com a scam? TrustSniffer's high-risk assessment: 3/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page promotional site for a "Scratchy Cup 2026" competition. Its homepage title advertises a prize of 50M CSC and presents the offer as a joint "CasinoCoin x LuckyHash" campaign. It appears to be a crypto-linked casino or scratch-card gaming promotion, and its apparent business model is to draw visitors into token-based gaming play on the strength of a large headline prize.

Scam/Impersonation Risk

Contradictory signals are present and carry decisive weight. The domain is blacklisted, and multiple major security engines independently classify it as malicious, which is a stronger and more corroborated signal than a single-source flag. Protective hosting and a valid certificate do not offset this. No conflicting legal identities and no confirmed brand-impersonation finding were observed. The risk is driven by reputation and by the site's profile. The homepage's headline claim of a "CasinoCoin x LuckyHash" partnership and a 50M CSC prize is a high-value inducement. Nothing in the evidence independently corroborates the partnership, and a newly registered domain borrowing an established token's name is a common pattern for lure pages. Automated browsing showed no wallet-connection prompts, clipboard tampering, hidden forms or content cloaking. However, the homepage sent several data submissions to non-whitelisted third-party endpoints, and a large share of its outbound traffic went to external hosts. It also produced repeated client-side console errors. That behaviour is out of proportion for a one-page promotion and warrants caution about what data a visitor's session may transmit. Evidence:

• Homepage: the title advertises a "Scratchy Cup 2026" with a 50M CSC prize and a CasinoCoin partnership claim that nothing in the evidence corroborates.
• Homepage behaviour: three external POST submissions to non-whitelisted destinations and six external XHR calls, with up to 71.4% of requests going to external hosts.
• Domain provenance: registered 2026-07-16 (~0.28 years old) through NICENIC INTERNATIONAL GROUP CO., LIMITED.
• Web-archive depth: 1 snapshot, captured 2026-07-20 (1 year tracked), so there is no meaningful history.

Regulatory Verification Notes

Nothing in the evidence connects the site to a gambling licence, a financial registration, or an identifiable operating company. No third-party regulatory or broker-reputation record matched the site, and the on-page disclosure position could not be established. For a site that offers token-denominated gaming and prizes, the absence of any traceable licensing or operator information is a material verification gap. It does not by itself prove wrongdoing, but here it compounds the confirmed reputational findings rather than standing alone. The partnership with a named token project and the "2026" competition framing remain unverified marketing claims, not established facts. Evidence:

• Homepage: the "CasinoCoin x LuckyHash" co-branding is presented without any visible regulatory or corporate attribution in the analysed evidence.
• Hosting infrastructure: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-12. Domain validation confirms control of the domain, not the identity of its operator.

What to Verify Next

Before any engagement, confirm the claimed partnership directly with the official CasinoCoin project through channels reached independently of this site, not through any link or contact detail it provides. Check whether the operator holds a gambling licence in a jurisdiction that regulates it, using the relevant regulator's public register. Do not connect a crypto wallet or deposit tokens on this domain as a test. Re-check the domain's external reputation status after any remediation claim before changing the assessment. Evidence:

• Homepage: the 50M CSC prize and partnership claim are the primary assertions that need independent confirmation.
• Homepage behaviour: outbound submissions to non-whitelisted third parties are an additional reason to avoid entering any personal or wallet information.

Summary Verdict

The overall posture is high risk. Corroborated blacklist detections from several independent security sources outweigh the technically healthy surface, and the very recent registration with no archive track record gives no historical record to counter them. Legitimacy cannot be established, and the site is unsuitable for any sensitive interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers. The actual origin host was not observable, so hosting cannot be independently verified, and edge-only visibility can mask rapid content changes. This is a mitigating factor only. Protective infrastructure is widely available to any operator, including malicious ones, and it cannot offset the external threat detections.

Closing Assessment

Account login, credential entry, wallet connection and any financial transaction should be avoided. At most, treat the site as read-only, and only from an isolated browser session.