gearnax[.]com

Analysis of gearnax.com indicates a brand‑impersonation campaign targeting x.com that has been taken offline as of the report date, July 25 2026. The domain was registered on September 08 2025 through NiceNIC International Group Co., Limited and points to the Cloudflare‑managed address 172.67.208.73, AS13335 in the United States. No SSL certificate is present, and HTTP requests return an offline status, suggesting the site is no longer serving content. The page title retrieved before takedown reads "Gearnax: Most Popular Online Crypto Casino Based on Blockchain," aligning with the listed scam type of a crypto scam and the identified phishing kit labeled as a Gambler Scam.

Reputation signals are extremely poor: Gridinsoft assigns a trust score of 1 out of 100, the domain appears on a single security blocklist, and PhishDestroy has actively blocked it. VirusTotal scans show that 9 of 95 antivirus engines flag the domain, reinforcing its malicious classification. Nameservers koa.ns.cloudflare.com and melinda.ns.cloudflare.com confirm the use of Cloudflare DNS.

Defenders should update intrusion detection and web filtering rules to block both the domain and its associated IP range, monitor for any re‑registration attempts, and enforce strict outbound controls to prevent connections to Cloudflare‑hosted assets that lack TLS. Incident response teams should also audit logs for any recent traffic to the IP address or to URLs containing the "Gearnax" keyword, as remnants of the campaign may persist in compromised client browsers or credential‑harvesting scripts. Continuous threat‑intel feeds should be consulted for new indicators tied to the Gambler Scam kit, and any observed attempts to replicate the brand‑impersonation technique against x.com should be escalated under the elevated risk level.