lixroll[.]com

On 23 July 2026, the domain lixroll.com was observed as an elevated‑risk brand‑impersonation site targeting the Blast brand. The domain was registered on 15 July 2025 through MAT BAO CORPORATION and resolves to the IPv4 address 57.129.97.29, which belongs to AS16276 (OVH SAS) located in Germany. The site presented the page title “LIXROLL | Enter the world of sport and stakes!”, suggesting a gambling‑oriented theme, and the underlying phishing kit has been identified as the Gambler Scam package. SSL inspection shows a certificate issued to XUI.one, which does not match the domain name, a common indicator of fraudulent infrastructure.

Reputation scoring from Gridinsoft rates the domain at 16 / 100, reflecting a low trust level. VirusTotal analysis recorded detections from 10 of 95 scanned vendors, confirming malicious activity. The domain appears on a single security blocklist and has been taken offline, with PhishDestroy reporting the takedown. Current HTTP probing returns no active service, confirming the offline status.

Uncertainty remains regarding the exact phishing payload and any active credential‑harvesting pages, as the site content has not been publicly retrieved. Defenders should continue to block the IP address 57.129.97.29 and the domain name lixroll.com at perimeter and DNS layers, monitor for any re‑registration attempts, and add the associated certificate fingerprint to SSL inspection rules. Additional correlation with threat‑intel feeds for the Gambler Scam kit and OVH‑hosted malicious infrastructure is recommended to detect potential campaign variants.