maonax[.]com

maonax.com was registered on 2025-10-09 through NiceNIC International Group Co., Limited. The domain resolves to the Cloudflare address 188.114.97.3, which belongs to AS13335 and is located in the United States. No TLS certificate is presented, indicating that the site was served over plain HTTP. The page title observed for the site reads “Maonax: Most Popular Online Crypto Casino Based on Blockchain,” matching the known Gambler Scam phishing kit classification. The kit explicitly impersonates the brand x.com, suggesting a targeted brand‑impersonation vector designed to lure users into a cryptocurrency‑related gambling fraud.

Detection services have flagged the domain: seven of ninety‑five VirusTotal scanners reported malicious activity, and the domain appears on a single security blocklist. The blocklist entry and the fact that PhishDestroy has taken the domain offline confirm that the infrastructure is no longer active. Reputation metrics are extremely low, with a Gridinsoft trust score of 1 out of 100. DNS records list milan.ns.cloudflare.com and shubhi.ns.cloudflare.com as authoritative nameservers, confirming the use of Cloudflare’s DNS service.

The combination of a recent registration date, low trust score, absence of SSL, and detection by multiple vendors provides strong evidence that maonax.com was used for a crypto‑scam campaign impersonating x.com. Defensive recommendations include adding the domain to perimeter blocklists, denying traffic to the IP address 188.114.97.3, and monitoring Cloudflare‑hosted IP ranges for new domains that resolve to the same address. Email and web filtering policies should be updated to flag any references to “Maonax,” “crypto casino,” or the brand x.com, especially when coupled with requests for cryptocurrency transactions. Although the site is currently offline, threat actors may redeploy the same kit under a different domain, so continuous observation of registration patterns and hosting infrastructure is advised.