tusewin[.]one

tusewin.one was observed on 23 July 2026 as an offline HTTP endpoint returning status 403. The domain resolves to 172.67.167.74, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by naya.ns.cloudflare.com and rocky.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and CDN services. The SSL certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake despite the site being taken down. Threat intelligence indicates that the site employed the publicly‑available “Gambler Scam” phishing kit, as identified by analysis of the page title, which simply reads “tusewin.one”.

The kit is typically used to harvest credentials for gambling‑related services. The domain was registered on 21 February 2026 through NameSilo, LLC, and has a Gridinsoft trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal records show that 13 of 93 scanning engines flagged the domain, and the indicator is present on at least one external blocklist. PhishDestroy has also added the domain to its block list, confirming that security vendors consider it a phishing source.

Because the site is currently offline, active exploitation cannot be confirmed, but the combination of a low trust score, multiple vendor detections, and the presence of a known gambling‑scam kit suggests a continued risk for users who may encounter the domain in email or referral traffic. Defenders should ensure that outbound filtering blocks connections to the IP 172.67.167.74 and that DNS resolvers deny queries for tusewin.one. Existing web‑proxy or firewall rule sets that reference the Cloudflare nameservers can be used to enforce denial. Continuous monitoring of the domain’s registration status and any re‑appearance on threat feeds is recommended, as the operators may reactivate the site using the same infrastructure.