Boomwins (BOOMWIN, TOGOO, LOOSESLOT): what we found
A casino web app on a Chinese-built platform that runs several casino brands from one server. Its landing page hides from visitors the platform chooses to block, and its slot games come from domains made to look like real game studios.
Public since 2026-10-31. A warning for players. Not yet reported to its registrars or hosts.
Site: boomwins.cc (written out, not linked: don't open it with a wallet connected).
Status: Whether it pays out is unknown: no money was deposited.
Findings
warning sign
Slot games come from lookalike game-studio domains
In a capture of the web app on a phone (2026-10-22), all 3 MB of game data came from pp.pragmaticsplaygames.com. Pragmatic Play's real domain is pragmaticplay.net. Another server, api-usa.pgf-games.com, looks like PG Soft. Both domains were registered at Gname on the same day (2025-10-08) and changed on the same day (2026-08-22). Games served from lookalike domains are run by the operator, not the studio.
pp.pragmaticsplaygames.comapi-usa.pgf-games.com
What to do: Don't deposit. A casino that serves "Pragmatic Play" games from a domain Pragmatic Play doesn't own controls the results itself.
warning sign
The landing page hides itself from reviewers
Before showing anything, the landing page's site-center-gate.js hides the page and asks the central server about the visitor's ad channel. If the answer is code 40003, it sends the visitor to a different page (/lp/atlas/). The start page (check.html) also detects Chrome's desktop device emulation, the tool ad reviewers and researchers use to look at mobile pages. This is how ads get past ad review.
site-center-gate.jscheck.html
info
One open server runs several casino brands
game.bigfoxes.com/slot-center/api/site/center answers any visitor with the whole setup for an ad channel: game server, accounts, an operator console, payments and live code updates. The app shells for BOOMWIN, TOGOO and LOOSESLOT all get their settings from game.togoo777.com, which builds an app for any brand name it is given. boomwins.cc, looseslot.cc and togoo777.com share a registrar (NameSilo) and nameservers (DNSOwl).
game.bigfoxes.comgame.togoo777.comboomwins.cclooseslot.cctogoo777.comtogoo.cc
info
Ads, tracking and a push into Chrome
The landing page loads a Meta (Facebook) pixel and a Bigo Ads pixel whose IDs come from each ad link, and the game uses FingerprintJS (device fingerprinting). A hidden pop-up (in Chinese) says the site asks to open Chrome "for a better experience": a way to move people out of Facebook's or TikTok's in-app browser into Chrome, where the web app can be installed. Pages are marked zh-Hans with Chinese code comments.
the landing pagethe game page
What we measured
| What | Result | How | Checked |
|---|---|---|---|
| boomwins.cc registered | 2026-06-01 at NameSilo (DNSOwl nameservers) | RDAP (rdap.org) | Oct 22, 2026 |
| togoo777.com registered | 2025-09-10 at NameSilo; certificates since 2025-09-11 | RDAP; crt.sh | Oct 22, 2026 |
| bigfoxes.com (the central server) registered | 2026-08-14 at Cloudflare Registrar | RDAP | Oct 22, 2026 |
| Withdrawals | Unknown: not tested, nothing was deposited | Not tested | Oct 22, 2026 |
Tools run on this project
Check it yourself
Every Pulse tool, live on mainnet, starting with whats_this. Paste a Solana address a casino or game asks you to pay, before you pay it.
Toolbox
Pick any tool, change any input, run it on mainnet, and reopen any call to change it and run it again.
Ctrl ↵ runs the tool
Run when unsure what an address is, before sending to it or passing it on. SOL sent to a token or program address can be lost for good. Read the docs
Response
Run the request to see the live response. The inputs are real mainnet data, so it works as it is.
Your calls 0
Calls you run appear here and stay in this browser. Open one to change its inputs and run it again.