1tan[.]casebin[.]at

1tan.casebin.at is a subdomain of casebin.at. PhishDestroy first observed the hostname on Aug 20, 2026. Current evidence score: 100/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Spamhaus DBL, and URLQuery. VirusTotal recorded 14 detections among 91 engines: BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Seclookup, Sophos, VIPRE, Webroot, Yandex Safebrowsing on Aug 20, 2026 at 08:40 UTC. Spamhaus DBL: DBL_ABUSED_PHISH on Aug 20, 2026 at 10:30 UTC. URLQuery recorded 2 detections; no observation timestamp was retained. Non-positive and contextual checks: Gridinsoft assigned a trust score of 1/100; no observation timestamp was retained. The separate external-blocklist snapshot contained no matches on Aug 20, 2026 at 10:20 UTC. Google Safe Browsing returned no flag on Aug 20, 2026 at 09:15 UTC. URLScan captured the page on Aug 20, 2026 at 08:37 UTC.

The collector marked the hostname reachable on Aug 20, 2026 at 08:37 UTC, but did not retain the HTTP response code. Registration records for the registrable domain casebin.at list helloly GmbH ( https://nic.at/registrar/743 ) as the registrar. At collection time, the hostname resolved to 107.189.20.230 on AS14956 (RouterHosting LLC). The recorded endpoint location is Zaandam, NL. The evidence archive retains 3 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Oct 12, 2026; checked Aug 20, 2026 at 10:02 UTC.

The record contains 3 positive source findings supporting the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.