hexcas[.]com

Analysis of the domain hexcas.com indicates a confirmed brand-impersonation phishing campaign targeting Camelot, as documented on July 22, 2026. The domain was registered on May 1, 2025, through Web Commerce Communications Limited and currently resolves to the IP address 176.97.79.105, hosted under AS58061 (Scalaxy B.V.) in the Netherlands. Infrastructure analysis reveals the use of Cloudflare nameservers (fish.ns.cloudflare.com and hasslo.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The site was flagged by PhishDestroy and appears on at least one security blocklist, though no SSL certificate was detected, increasing the likelihood of interception or tampering during data transmission.

The page title, 'Games - VAVADA Online,' does not directly reference Camelot, but the domain is explicitly classified as a brand-impersonation scam targeting Camelot in available threat intelligence. No active detections were recorded by the 95 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm legitimacy. The domain was taken offline prior to this report, limiting further analysis of its operational content or payload delivery mechanisms. Defenders should treat hexcas.com as a confirmed malicious domain associated with brand impersonation.

Network-level blocking of the IP 176.97.79.105 and monitoring for related Cloudflare-nameserver domains are recommended. Organizations targeted by Camelot-themed phishing should review logs for connections to this IP or domain, particularly during the period it was active. Given the use of Cloudflare, additional domains sharing the same nameservers may warrant proactive investigation. No further details about the phishing kit, lure content, or victim demographics are available at this time.