xirvan[.]com

This domain is flagged for elevated-risk brand impersonation, specifically targeting users of crypto-based gambling platforms. Analysis indicates the infrastructure is designed to deceive victims by mimicking legitimate online casinos, potentially leading to financial theft or unauthorized cryptocurrency transactions. The threat type is classified as brand impersonation, with no evidence of credential harvesting or crypto drainer functionality at this stage, though secondary payloads cannot be ruled out. Infrastructure analysis reveals the domain xirvan.com was registered on October 11, 2025, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a common obfuscation tactic to mask origin servers. The domain lacks an SSL certificate, increasing the likelihood of interception or tampering. Security vendor detections on VirusTotal stand at 11/95, with one active blocklist entry. The page title, 'Xirvan: Most Popular Online Crypto Casino Based on Blockchain,' reinforces the brand impersonation theme, while the domain's current offline status suggests takedown action or operational pause. Mitigation steps for this threat type include immediate blocking of the domain and associated IP (188.114.97.3) at network perimeter controls. Organizations should monitor for related domains registered through Dominet (HK) Limited or resolving to Cloudflare IPs, as these may indicate follow-up campaigns. End users should be educated to verify gambling platforms via official channels, particularly those claiming blockchain integration, and to scrutinize domain registration dates—newly created domains (e.g., post-October 2025) are high-risk. Cryptocurrency transactions initiated from such sites should be treated as fraudulent, and wallet addresses associated with the domain should be flagged for monitoring.