floxwin[.]com

This domain, floxwin.com, is identified as a brand-impersonation threat specifically targeting users of cryptocurrency gambling platforms. Analysis indicates it operates as a fraudulent crypto casino, mimicking legitimate blockchain-based gambling services to deceive victims into depositing digital assets under false pretenses. The site employs a known phishing kit labeled 'Gambler Scam,' designed to harvest credentials, payment details, and cryptocurrency wallet information through deceptive interfaces and fake promotional offers. Users are lured with promises of high-stakes gambling, bonuses, and blockchain transparency, which are entirely fabricated to facilitate financial theft. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on September 11, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with fraudulent activity. It resolves to the IP address 104.21.76.157, a shared hosting environment commonly exploited for malicious operations. Security vendors on VirusTotal flagged floxwin.com with 8 detections out of 95, while Gridinsoft and Scamadviser assigned trust scores of 0/100 and 1/100, respectively. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The page title, 'Floxwin: Most Popular Online Crypto Casino Based on Blockchain,' directly impersonates legitimate gambling platforms, further confirming its fraudulent intent. Users who visited floxwin.com or interacted with its content should take immediate action to mitigate risk. Discontinue all engagement with the site and revoke any permissions granted to associated applications or browser extensions. If cryptocurrency transactions were initiated, contact the relevant exchange or wallet provider to report potential fraud and attempt to freeze or reverse transfers. Reset credentials for any accounts linked to the site, particularly those tied to financial services or cryptocurrency wallets. Monitor financial statements and blockchain transactions for unauthorized activity. Given the elevated risk level and confirmed offline status, this domain should be treated as a confirmed threat vector for financial fraud and credential theft.