wasewin142[.]to

The domain wasewin142.to was created on March 16, 2026 and is currently taken offline. Infrastructure analysis shows the domain is delegated to Cloudflare nameservers lia.ns.cloudflare.com and titan.ns.cloudflare.com, resolving to the IP address 172.67.191.66, which belongs to AS13335 Cloudflare, Inc. in the United States. Registration was performed through Gname.com Pte. Ltd., a registrar known to host a variety of short‑lived domains. The site presented a page titled "Wasewin142: Most Popular Online Crypto Casino Based on Blockchain" and is classified as a brand impersonation scheme that uses a Gambler Scam phishing kit.

Technical fingerprints include the presence of Twitter Ads, a Facebook Pixel, Cloudflare Browser Insights, and the Cloudflare CDN itself. The TLS certificate is issued by Let’s Encrypt (E8), indicating a standard free certificate without additional validation. A Gridinsoft trust score of 33 out of 100 further reflects low reputation. Detection data shows that 16 of 91 security vendors on VirusTotal flagged the domain, and the site appears on three external blocklists.

Additional blocking is applied by PhishDestroy, MetaMask, and SEAL, confirming that multiple anti‑phishing services have identified the domain as malicious. While the offline status prevents immediate interaction, defenders should still update their URL filtering and DNS blocklists to include wasewin142.to, monitor for any re‑registration or resurrection of the domain, and ensure that any inbound traffic to the associated IP is logged and inspected. Given the brand impersonation context and the presence of a gambling‑related phishing kit, organizations should alert users about potential credential‑stealing attempts that masquerade as a crypto casino service, especially those targeting users of blockchain wallets or crypto exchanges. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is recommended, as the infrastructure can be reused for future campaigns.