phishdestroysuckdick[.]xyz

Analysis of the domain phishdestroysuckdick.xyz, created on 29 September 2025 and currently reported as taken offline, indicates a confirmed crypto‑related phishing operation. The authoritative nameservers gabriel.ns.cloudflare.com and tani.ns.cloudflare.com resolve the domain to the Cloudflare edge address 172.67.213.137, which is registered to AS13335 Cloudflare, Inc. in the United States. Registration was performed through Web Commerce Communications Limited. The site title observed during the brief scan reads “PHISHDESTROYSUCKDICK | Play at the best online casino based on Blockchain”, matching the Gambler Scam phishing kit and the declared scam type of a crypto scam. No TLS certificate was presented, leaving the HTTP service unencrypted.

Reputation services show the domain listed on one security blocklist and flagged by two of ninety‑five VirusTotal scanners. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain is also listed as blocked by the PhishDestroy feed. The available evidence confirms that the infrastructure is hosted on a shared Cloudflare network, a common choice for fast‑flux or opportunistic phishing sites. The lack of SSL, the low trust score, and the presence of a known gambling‑style phishing kit suggest the site was designed to lure victims into cryptocurrency‑based gambling scams.

Because the site is currently offline, the exact payload and credential‑capture mechanisms remain unverified; only the page title and kit attribution provide insight into the intended victim interaction. Defenders should immediately add phishdestroysuckdick.xyz to network and endpoint blocklists, enforce DNS filtering for the domain and its resolving IP 172.67.213.137, and monitor for other domains that resolve to the same Cloudflare edge nodes or that employ the Gambler Scam kit. Continuous observation of the associated nameservers may reveal re‑registration attempts.