tmuske[.]com

Analysis conducted on 25 July 2026 identifies tmuske.com as a newly registered domain that has been used in a generic phishing campaign. The domain was created on 21 February 2026 and is registered through Web Commerce Communications Limited. DNS resolution points to IP address 104.21.48.1, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The authoritative name servers are lovisa.ns.cloudflare.com and sterling.ns.cloudflare.com, confirming that the site is fronted by Cloudflare’s edge network. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS configuration but offering no assurance of legitimacy.

The page title returned during the brief crawl reads “TMUSKE | Open the world of luck and rewards!”, suggesting a lure built around rewards or gambling. No additional content was captured because the site was taken offline at the time of analysis. Threat‑intel feeds report that the domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scanning shows that one out of ninety‑three scanning engines flagged the domain, providing a modest but non‑trivial detection signal. Evidence confirms the use of standard cloud infrastructure and a legitimate‑looking certificate, a pattern commonly employed to increase trust among unsuspecting victims.

However, the paucity of public detections and the limited blocklist presence leave the full scope of the campaign uncertain. Defenders should monitor DNS queries for tmuske.com and its associated IP address, enforce URL filtering based on the observed blocklist entry, and consider adding the domain to internal deny lists. Additional observation of any future re‑hosting attempts or related domains registered by the same registrar may reveal whether the operators are migrating to new infrastructure.