buagux[.]com

Analysis of buagux.com shows that it was registered through GMO Internet, Inc. on March 23 2026 and resolved to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain employed a Let's Encrypt E8 certificate, indicating HTTPS was available while the site was active. Infrastructure data reveal that the authoritative name servers are kyrie.ns.cloudflare.com and maisie.ns.cloudflare.com, both hosted on Cloudflare’s network. Threat intelligence flags the domain as a Gambler Scam phishing kit. Four independent blocklists—PhishDestroy, MetaMask, SEAL, and two additional unnamed lists—have already marked the domain as malicious, and three security blocklists reference it.

VirusTotal scans show that 14 of 91 security vendors returned a positive detection for the domain, reinforcing the malicious assessment. Gridinsoft assigned a trust score of 1 out of 100, the lowest possible rating. The site is currently taken offline, and its HTTP status is not publicly observable. No public Safe Browsing or Open Threat Exchange entries were supplied, and no page‑title or content snapshot is available, leaving the exact landing‑page behavior uncertain.

Nevertheless, the convergence of registrar information, Cloudflare hosting, low trust score, multiple blocklist entries, and the Gambler Scam kit designation provides sufficient evidence for defensive actions. Defenders should add buagux.com to DNS‑based deny lists, ensure that network firewalls block traffic to 188.114.97.3, and propagate the indicator set to endpoint protection solutions. Continuous monitoring of the associated Cloudflare name servers is advised, as the adversary may recreate the site under a new sub‑domain. Organizations using the affected brand should educate users about unsolicited requests that reference gambling‑related offers, as the kit typically leverages social‑engineering tactics to harvest credentials.