xmuskcas[.]com

This domain, xmuskcas.com, was registered on 21 February 2026 and is presently taken offline. The site presented the page title “Xmuskcas: Elon Musk’s Official Crypto Casino Powered by Blockchain,” indicating a crypto‑casino lure that falsely references Elon Musk. Analysis of the hosting layer shows the domain resolves to IP address 172.67.217.254, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The SSL certificate presented as “WE1,” which does not correspond to a recognized certificate authority, further suggests a low‑trust configuration.

The campaign is associated with the publicly‑available “Gambler Scam” phishing kit, a toolkit commonly used to harvest credentials for cryptocurrency‑related services. VirusTotal scans report that 11 of 93 AV engines flagged the domain, confirming malicious behavior. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, demonstrating that at least one anti‑phishing service has taken protective action. AlienVault OTX lists the domain in one threat‑intel pulse, providing additional corroboration of its malicious nature.

No additional public reputation scores are available. Defenders should immediately block xmuskcas.com and its resolving IP 172.67.217.254 at the perimeter, enforce DNS sink‑hole rules, and monitor for any resurgence of the Gambler Scam kit in related traffic. Continuous watch of Cloudflare‑hosted assets for similar crypto‑casino lures is recommended, as the infrastructure can be rapidly re‑provisioned. Organizations that use brand monitoring for Elon Musk or cryptocurrency services should add this indicator to their threat‑intel feeds to improve detection of future phishing attempts that reuse the same thematic content.