luosax[.]com

The domain luosax.com is identified as a brand impersonation threat targeting online crypto gambling platforms. Analysis confirms this domain was designed to mimic legitimate blockchain-based casinos, specifically posing as a popular crypto casino under the name "Luosax." The threat type is classified as a phishing and fraud operation, leveraging deceptive branding to lure victims into financial scams. Technical indicators reveal the domain was registered on October 9, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.13.104 and has been flagged by 5 of 95 security vendors on VirusTotal. Additional data shows the domain appears on one security blocklist and holds a Gridinsoft trust score of 0 out of 100. The page title, "Luosax: Most Popular Online Crypto Casino Based on Blockchain," further confirms its intent to impersonate a legitimate gambling service. Infrastructure analysis indicates the use of the "Gambler Scam" phishing kit, a known toolset for deploying fraudulent gambling schemes. As of the latest assessment, luosax.com has been taken offline, reducing immediate risk to users. However, the infrastructure and tactics observed suggest potential for redeployment under a similar or altered domain. Organizations and individuals are advised to monitor for domains registered through NiceNIC International Group Co., Limited with recent creation dates, particularly those resolving to 104.21.13.104 or exhibiting gambling-related branding. Blocking access to the identified IP and implementing real-time domain reputation checks can mitigate residual risk. Users should verify the legitimacy of crypto gambling platforms through official channels and avoid engaging with unsolicited offers or promotions.