tirowex[.]com

Analysis as of July 24, 2026 indicates that the domain tirowex.com is presently taken offline. The site was hosted on Cloudflare infrastructure (ASN 13335) with the resolved address 104.21.34.194 located in the United States. No TLS certificate was observed, implying the service was delivered over plain HTTP. Registration information shows the domain was created on September 7, 2025 through Web Commerce Communications Limited, and it uses the Cloudflare authoritative nameservers keyla.ns.cloudflare.com and vicky.ns.cloudflare.com. The page title retrieved before takedown read “Tirowex: Most Popular Online Crypto Casino Based on Blockchain,” matching the listed scam type of a crypto‑based gambling lure.

The observed phishing kit is identified as the “Gambler Scam,” a known template used to mimic online casino sign‑in flows and harvest cryptocurrency credentials. Reputation data includes a Gridinsoft trust score of 1 out of 100, confirming an elevated malicious rating. The domain appears on one security blocklist and is listed as blocked by the PhishDestroy service. VirusTotal scans recorded 11 of 95 antivirus engines flagging the domain, providing additional corroboration of malicious intent. The limited number of blocklist appearances suggests the site may have been short‑lived or targeted at a niche audience.

Uncertainty remains regarding the exact payload delivered to victims, as the page content has not been archived and no HTTP status code is available. Defenders should treat tirowex.com as a high‑confidence indicator of a crypto‑casino phishing campaign. Recommended actions include adding the domain and its resolved IP address to network‑level deny lists, updating URL filtering rules, and sharing the indicator set with industry ISACs. Continuous monitoring of Cloudflare‑hosted assets for re‑use of the same nameservers or similar page titles can help detect potential re‑deployment of the Gambler Scam kit.