toxcas[.]com

Analysis of toxcas.com, created on July 31, 2025 and currently taken offline, reveals infrastructure consistent with a crypto‑based gambling phishing campaign. The domain resolves to IP address 69.5.189.54, which is registered to an autonomous system (AS42624) owned by Global‑Data System IT Corporation and geolocated to Switzerland. Registration was performed through NameSilo, LLC, and the domain is served by four nameservers (ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, ns4.nameserverhub.com). No SSL certificate is presented, indicating that the site operated over plain HTTP when active.

The page title observed during the brief capture reads "TOXCAS | Play at the best online casino based on Blockchain," aligning with the reported scam type of a crypto scam and the identified phishing kit labeled as a Gambler Scam. Threat intelligence sources have flagged the domain on at least one security blocklist and it is listed as blocked by PhishDestroy. VirusTotal scans show that two of ninety‑five security vendors flagged the domain, providing additional corroboration of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extreme lack of credibility.

While the site is offline, the combination of a recently registered domain, lack of HTTPS, low trust score, detection by multiple vendors, and presence on blocklists suggests a high likelihood of continued abuse if re‑hosted. Defenders should ensure that outbound connections to 69.5.189.54 are blocked, add toxcas.com to URL filtering and DNS block lists, and monitor for any re‑registration or resurrection of the domain. Continuous observation of the associated nameservers and the ASN for new activity is recommended, as threat actors may leverage the same hosting infrastructure for future campaigns.