corsux[.]com

Analysis of corsux.com, created on September 30, 2025 and currently taken offline, shows a clear pattern of brand impersonation targeting x.com. The site was hosted on Cloudflare infrastructure (ASN 13335) with the IPv6 address 2606:4700:3034::6815:29da located in the United States. Both authoritative nameservers, galilea.ns.cloudflare.com and margo.ns.cloudflare.com, resolve to the same Cloudflare network, indicating the attacker leveraged a reputable CDN to mask the true origin. The domain was registered through NiceNIC International Group Co., Limited, and no SSL certificate was presented, leaving the connection unencrypted.

The page title "Corsux: Most Popular Online Crypto Casino Based on Blockchain" aligns with the declared scam type of a crypto scam and matches the Gambler Scam phishing kit observed in related investigations. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the site’s legitimacy. The domain appears on one security blocklist and has been actively blocked by PhishDestroy.

VirusTotal scans recorded 10 detections out of 95 security vendors, reinforcing the malicious classification. Defenders should immediately block the domain and associated IPv6 address at perimeter and DNS layers, monitor for any new registrations resembling the corsux.com pattern, and apply heuristic rules for Cloudflare‑hosted crypto‑casino kits. Continuous threat‑intel feeds should be queried for other domains using the same Gambler Scam kit or referencing the x.com brand, and incident response teams should alert users of potential credential harvesting attempts tied to the impersonated brand.