casnyx[.]com

Analysis of casnyx.com, observed on July 24, 2026, indicates that the domain was actively used for a crypto‑focused phishing campaign before being taken offline. The site resolved to the IP address 188.114.96.3, which is hosted in the United States under ASN 13335 operated by Cloudflare, Inc. The domain was registered on October 03, 2025 through Dominet (HK) Limited and is delegated to the Cloudflare nameservers bayan.ns.cloudflare.com and clara.ns.cloudflare.com. No SSL certificate was presented, leaving the connection unencrypted, and the Gridinsoft trust score assigned a rating of 1 out of 100, reflecting extreme suspicion. The page title returned by the site, "Casnyx: Most Popular Online Crypto Casino Based on Blockchain," aligns with the declared scam type of a crypto scam and matches the Gambler Scam phishing kit identified in the intelligence feed.

The domain appears on a single security blocklist and has been specifically blocked by the PhishDestroy service. VirusTotal analysis recorded 11 detections out of 93 security vendors, reinforcing the malicious classification. Although the site is currently offline, the combination of a low trust score, lack of TLS, a recent registration date, and multiple vendor detections provides strong evidence of fraudulent intent.

Uncertainty remains regarding the exact content served at the time of operation, as no snapshot of the page HTML or captured credentials is available. Defenders should continue to block the domain and its associated IP, monitor for any re‑registration attempts, and consider adding the registrar Dominet (HK) Limited to watchlists, given its recent use in this campaign. Ongoing surveillance of Cloudflare‑hosted infrastructure and related phishing kits is recommended to mitigate future occurrences.