refhot.fun
Appeared in the .fun zone on Tuesday, October 27, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The throwaway referral-style name (refhot.fun on free dnsowl DNS) redirects to a Russian-language Telegram channel (@it_1win) pushing 1win casino slots, crypto deposits and free spins, with links to a 1win mirror domain (1wkvjy.com). That makes it an unlicensed-gambling funnel. The Telegram branding and search form belong to the destination and are not impersonation.
refhot.fun is a redirect-only domain with no independent content, using free DNS (dnsowl.com) and the .fun TLD, redirecting to a Telegram channel (t.me/s/it_1win) promoting 1win gambling. The domain name 'refhot' combined with redirect-only infrastructure and gambling promotion indicates this is a referral/affiliate squat domain designed to funnel traffic to an unlicensed gambling operation; the scorer evidence of 54 reflects multiple abuse signals (free DNS, suspicious TLD, form presence, and g
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Tuesday, October 27, 2026
Same data as JSON: /api/zone/domain/refhot.fun. This page is not indexed by search engines and does not link to the site it describes.