woamax[.]com

On July 23, 2026, investigators observed that the domain woamax.com was registered on December 5, 2025 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare address 104.21.60.40, which belongs to AS13335 in the United States. The domain is served by the Cloudflare nameservers cameron.ns.cloudflare.com and kiki.ns.cloudflare.com, and no TLS certificate is presented, indicating an unencrypted HTTP service. The public page title returned by the site reads “Woamax: Most Popular Online Crypto Casino Based on Blockchain,” suggesting a cryptocurrency‑focused gambling front‑end. Threat intelligence correlates the site with a “Crypto Scam” classification and identifies the underlying phishing kit as the “Gambler Scam” package. The domain is explicitly listed as impersonating x.com, a brand target referenced in the intelligence set.

Detection signals show that 15 of 95 security vendors on VirusTotal have flagged the domain, and it appears on a single security blocklist. The PhishDestroy service has already blocked the domain, and AlienVault OTX contains one pulse referencing it. Gridinsoft assigns a trust score of 1 out of 100, reinforcing the malicious assessment. The infrastructure is currently marked offline, but the presence of the domain in multiple detection feeds warrants continued monitoring.

Uncertainty remains around the exact content served at the URL, as no SSL certificate and the offline status prevent direct observation of the page’s HTML or any credential‑capture mechanisms. Defenders should add woamax.com to blocklists, enforce DNS sink‑hole policies, and monitor Cloudflare‑associated IP 104.21.60.40 for any re‑activation. Continuous scanning with multi‑vendor services is recommended to capture any future changes in the domain’s hosting or kit deployment.