REGISTRAR NEGLIGENCE · EGREGIOUS Global Domain Group LLC was notified 3 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-04-04 21:06:46 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 8 times, most recently 2026-04-04 21:06:46 UTC) to abuse@verisign-grs.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 3 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If Global Domain Group LLC doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 8 separate notifications over 3 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

3 months

Reports sent

Latest case ID

PD-20260404-D39625

Current status

Serving traffic (alive)

Domain security & threat intelligence

levopex[.]com

فحص التصيد والأمان للنطاق levopex.com

“Levopex: Elon Musk’s Official Crypto Casino Powered by Blockchain”

11/91 VT Active threat Apr 05, 2026 Genericcrypto احتيال على المقامرين Social Media Phishing 8 Reports Sent

CA + more

Risk Score: 98 out of 100. Critical risk.

ملخص التقرير

levopex.com: أظهرت نتيجة VirusTotal أن 11 من أصل 91 محركًا رصد هذا النطاق. راجع DNS وSSL وجهة التسجيل وقوائم الحظر.

يبقى تحليل PhishDestroy AI المفصل أدناه باللغة الإنجليزية للحفاظ على السجل الجنائي الرقمي الأصلي.

PhishDestroy AI

HIGH

Analysis of levopex[.]com shows a high‑risk, active phishing infrastructure targeting cryptocurrency gambling users. The domain was registered on April 04, 2026 through Global Domain Group LLC and resolves to Cloudflare‑hosted IP 188.114.96.3 in Canada, using the Cloudflare nameservers eve.ns.cloudflare.com and isaac.ns.cloudflare.com. The site presents the page title "Levopex: Elon Musk’s Official Crypto Casino Powered by Blockchain," indicating an attempt to impersonate a crypto casino brand. Technical fingerprints include Twitter Ads, Facebook Pixel, Cloudflare Browser Insights, and a Let’s Encrypt/E8 TLS certificate, all typical of malicious pages designed to blend with legitimate advertising ecosystems. VirusTotal scans have flagged the domain by 14 of 94 security vendors, and Gridinsoft assigns a trust score of 98/100, underscoring its malicious nature. The operation is classified as a social media phishing campaign employing a known Gambler Scam kit. It is already blocked by PhishDestroy and appears on one external blocklist, but the HTTP response remains 200, confirming the site is serving content. Defenders should immediately add levopex[.]com to network and endpoint blocklists, monitor DNS queries for the associated Cloudflare IP range, and educate users about unsolicited crypto casino promotions. Continuous monitoring is advised to detect any pivoting of the infrastructure or emergence of new indicators.

VirusTotal

11 det.

URLScan

Report ↗

Gridinsoft

1/100

SSL

Let's Encrypt

العمر

4 mo

Observed status

Active threat 200

قائمة الإتلاف

Listed

Reports Sent

8 ignored

نطاق تغطية البيانات VirusTotal 11 / 91 URLQuery no detections OTX no pulses رادار CF suspicious URLScan report ready حجب عناوين DNS none SSL valid, 44d WHOIS 4 mo old Screenshot لم يتم تسجيله سلسلة إعادة التوجيه not probed Gridinsoft 1/100

مسار الاستجابة للتهديدات Pipeline

Discovery

Checks

Reports

Availability

18/19

الاكتشاف والاستيعاب الاستباقي

تم استيعاب التهديد

1/1 ✓

تم استيعاب التهديد

levopex.com تم اكتشافها وإدراجها في قائمة الانتظار لإجراء تحليل شامل

Apr 05, 2026

Threat Intelligence Checks

Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · VT Detection +12

8/8 ✓

رادار Cloudflare

Scanned via رادار Cloudflare — DNS, certificates & network data

Web Archive

Preserved in آلة الزمن — historical evidence archived

VirusTotal

11 / 91 vendors flagged on VirusTotal

Jul 28, 2026

Google Safe Browsing

Checked via تقرير الشفافية من Google

Jun 26, 2026

Brand Impersonation

Impersonation of Genericcrypto

Forensic Evidence Collected

Stored evidence from URLScan.io, URLQuery, stored screenshot

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Aug 02, 2026

VT Detection +12

+12 new detections (2 → 14): ADMINUSLabs, BitDefender, CRDF, Chong Lua Dao +8

Jun 26, 2026

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · ICANN Escalation #8 · 7 Reports Filed

8/8 ✓

Initial Abuse Report (#1)

Sent to 3 abuse contacts at Global Domain Group LLC with forensic evidence