luxor[.]win

On July 24, 2026, analysis of the domain luxor.win was completed. The domain was registered through Dynadot LLC on July 03, 2025 and is served by the authoritative nameservers ns1.nameserverhub.com and ns2.nameserverhub.com. DNS resolution points to the IPv4 address 69.5.189.58, which belongs to AS42624 (Global-Data System IT Corporation) and is geolocated to Switzerland. No TLS certificate is presented, indicating that the site was delivered over plain HTTP when it was active. The page title observed during the brief capture phase reads “LUXOR | Play at the best online casino based on Blockchain,” and the underlying infrastructure matches the publicly known “Gambler Scam” phishing kit, classifying the operation as a crypto‑focused scam.

The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed. Independent scanning on VirusTotal returned six positive detections out of ninety‑five engines, confirming malicious behavior. The Gridinsoft trust score of 0/100 further reinforces the low credibility of the host. As of the time of reporting the site has been taken offline, and no active HTTP response was observed. Defenders should continue to block the IP 69.5.189.58 and add luxor.win to local and network‑wide deny lists.

Monitoring of the registrar Dynadot for any re‑registration or rapid changes to the DNS records is advised, as attackers frequently recycle infrastructure. Because the site lacks SSL, any future activation would be trivially interceptable, but the presence of a known gambling‑related phishing kit suggests that the threat actor may reuse the same template against other cryptocurrency‑related brands. Organizations should educate users about unsolicited invitations to blockchain casino platforms and enforce URL verification controls. At present, no additional artifacts such as malware payloads or credential‑stealing forms have been publicly released, leaving the full scope of the campaign uncertain.