hasewin[.]gl

The domain hasewin.gl is currently flagged as an active phishing threat specializing in brand impersonation targeting online crypto gambling platforms. Analysis confirms the domain mimics a blockchain-based crypto casino, as evidenced by its page title, 'Hasewin: Most Popular Online Crypto Casino Based on Blockchain.' This campaign is classified under high-risk brand impersonation, with the specific objective of deceiving users into engaging with fraudulent gambling services. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). Detection metrics indicate 19 of 95 security vendors on VirusTotal have flagged hasewin.gl as malicious, while Google Safe Browsing has explicitly categorized it as phishing. The domain also appears on one security blocklist, and its SSL certificate is issued by Let’s Encrypt (serial number E7). These indicators collectively confirm the domain’s involvement in a coordinated phishing operation. Current status remains active, posing a significant risk to users seeking legitimate crypto gambling services. Organizations and individuals are advised to block the domain at the DNS or network level, and security teams should update detection rules to include the IP 188.114.97.3 and associated indicators. End users should avoid interacting with the domain and report any encounters to relevant fraud monitoring platforms. Proactive monitoring of newly registered domains under the same registrar may help identify related threats.