goawax[.]com

Analysis of goawax.com, a domain created on November 04, 2025 and registered through NiceNIC International Group Co., Limited, shows multiple indicators of malicious activity targeting cryptocurrency users. The site resolves to IP address 172.67.190.121, which belongs to AS13335 Cloudflare, Inc. in the United States, a common hosting platform for abuse‑hosting operators. No TLS certificate is presented, meaning the site is served over plain HTTP, which reduces the credibility of any purported financial service and eases interception by network adversaries. The page title, "Goawax: Most Popular Online Crypto Casino Based on Blockchain," aligns with the listed scam type of a crypto scam and suggests the deployment of a Gambler Scam phishing kit, a known template used to lure victims with fake gambling incentives.

Threat intelligence sources flag the domain on one security blocklist and PhishDestroy has already taken it offline, confirming active mitigation by at least one anti‑phishing service. VirusTotal scans report 16 detections out of 93 participating vendors, reinforcing the consensus that the domain distributes malicious content. The Gridinsoft trust score of 0/100 further indicates a high confidence of abuse. Nameservers annalise.ns.cloudflare.com and maciej.ns.cloudflare.com are standard Cloudflare entries and do not provide additional reputation signals.

Uncertainty remains regarding the current content of the site, as it is listed as offline and no SSL certificate is available for inspection. However, the combination of a recent registration date, Cloudflare‑hosted IP, lack of encryption, a fraudulent gambling‑oriented title, and multiple vendor detections provides a compelling case that goawax.com operates as a crypto‑focused phishing portal. Defenders should continue to block the domain on network perimeter filters, update threat‑intel feeds with the observed indicators, and monitor the associated IP range for any re‑use.