# PhishDestroy threat dossier — tetugamb.com ================================================================ Fetched: 2026-07-13 09:32:32 UTC Canonical: https://phishdestroy.io/domain/tetugamb.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation Phishing kit: Gambler Scam Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 10/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, CRDF, CyRadar, Forcepoint ThreatSeeker, G-Data, Gridinsoft, Kaspersky, SOCRadar, Sophos URLQuery: 2 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 2a06:98c1:3121::3 (US, San Francisco) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS13335 Cloudflare, Inc. Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: hunts.ns.cloudflare.com, poppy.ns.cloudflare.com Registered: 2026-05-31 Expires: 2027-05-31 Page title: Tetugamb: Most Popular Online Crypto Casino Based on Blockchain HTTP response: 666 (custom cloaking code — see Cloaking above) ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-08-29 Status: INVALID chain Fingerprint: d302f2753a685f151c8636dd0824a557443ca7c3635838fade71a0ebad496280 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-31 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-17 19:12:45 UTC (by PhishDestroy tracker) First reported: 2026-06-17 19:58:47 UTC (abuse notice filed) Last verified: 2026-07-13 08:20:41 UTC Neutralised: 2026-06-19 00:18:00 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019ed691-4e53-75df-88f5-61971c4dbfa6/ URLQuery: https://urlquery.net/report/0a11a341-609b-4e51-ba8d-8a26119804b1 Wayback Machine: https://web.archive.org/web/*/tetugamb.com crt.sh CT logs: https://crt.sh/?q=%25.tetugamb.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tetugamb.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/tetugamb.com URLhaus: https://urlhaus.abuse.ch/host/tetugamb.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 19:58:31 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, tetugamb.com, is actively engaged in brand impersonation targeting Base, a blockchain platform. Analysis indicates the site operates as a fraudulent online crypto casino, a tactic commonly associated with phishing and financial scams. The domain remains active and poses an elevated risk to users who may be deceived into engaging with its content under false pretenses. Infrastructure analysis reveals the domain was registered on May 31, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IPv6 address 2a06:98c1:3121::3 and uses a Let's Encrypt SSL certificate. Security vendor assessments show 10 of 95 VirusTotal engines flag the domain as malicious, while it appears on one security blocklist. The Gridinsoft trust score for this domain is 0/100, further confirming its suspicious nature. The page title, 'Tetugamb: Most Popular Online Crypto Casino Based on Blockchain,' aligns with known Gambler Scam phishing kits designed to exploit users seeking cryptocurrency-related services. The domain remains active and unmitigated, requiring immediate caution. Users are advised to block all connections to tetugamb.com and avoid interacting with its content. Network administrators should update firewall rules to deny traffic to the IP address 2a06:98c1:3121::3 and monitor for related indicators of compromise. Organizations should also educate users about the risks of brand impersonation scams, particularly those involving cryptocurrency platforms, to prevent financial loss or credential theft. [Updates since narrative was generated:] - VirusTotal detections: now 10/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260617-465BE4 Favicon MD5: 50679c0c5e3ed56d05c1d0ed312419a7 TLS cert SHA-256: d302f2753a685f151c8636dd0824a557443ca7c3635838fade71a0ebad496280 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tetugamb.com/ JSON API: https://api.destroy.tools/v1/check?domain=tetugamb.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 178,033 domains (49,760 alive under monitoring, 128,273 confirmed takedowns/dead). Site: https://phishdestroy.io