gambix[.]vip

On July 23, 2026, the domain gambix.vip was observed actively serving content with HTTP status 200. The site presents the title “GAMBIX | Play at the best online casino based on Blockchain”, indicating a crypto‑focused gambling lure. The SSL certificate is issued by Let’s Encrypt (YR1), confirming that TLS is in place but offering no assurance of legitimacy. Scamadviser assigns a trust score of 45 out of 100, reflecting a low reputation. The domain resolves to the IPv4 address 69.5.189.54, which maps to an AS42624 network operated by Global‑Data System IT Corporation in Switzerland. The registrar listed is NameSilo, LLC, and the domain was created on 3 June 2025, suggesting a relatively recent registration.

Nameserver records point to four entries under nameserverhub.com. Detection telemetry shows that 12 of 93 security vendors on VirusTotal flagged the domain, and it appears on one external blocklist. The site has been blocked by the PhishDestroy service, and a single AlienVault OTX pulse references the indicator. Analysis of the payload matches the publicly known “Gambler Scam” phishing kit, which is commonly used to harvest cryptocurrency credentials. The overall risk rating is high, and the threat type is classified as a crypto scam.

Uncertainty remains regarding the current volume of victim interaction and whether additional infrastructure beyond the observed web host is employed. No further evidence of credential‑harvesting pages or payment gateways has been disclosed. Defenders should add gambix.vip to URL filtering and sinkhole lists, monitor DNS queries for the associated nameservers, and enforce TLS inspection to detect the Let’s Encrypt certificate. Network security teams are advised to block outbound connections to 69.5.189.54 and to flag any authentication attempts to cryptocurrency wallets that originate from this domain. Continuous monitoring of threat‑intel feeds for new OTX pulses or blocklist entries is recommended.