REGISTRAR NEGLIGENCE · EGREGIOUS Global Domain Group LLC was notified 5 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-03-04 15:52:54 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 8 times, most recently 2026-03-04 15:52:54 UTC) to abuse@verisign-grs.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 5 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If Global Domain Group LLC doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 8 separate notifications over 5 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

5 months

Reports sent

Latest case ID

PD-20260304-4B92C0

Current status

Serving traffic (alive)

Domain security & threat intelligence

nirudex[.]com

nirudex.com için kimlik avı ve güvenlik kontrolü

“Nirudex: Elon Musk’s Official Crypto Casino Powered by Blockchain”

14/91 VT Active threat Mar 04, 2026 Genericcrypto Kumar Dolandırıcılığı Crypto Scam 8 Reports Sent CDN + more

Risk Score: 100 out of 100. Critical risk.

Rapor özeti

nirudex.com: 91 VirusTotal tarayıcısının 14 tanesi alan adını işaretledi. DNS, SSL, kayıt kuruluşu, engelleme listeleri ve tehdit verilerini inceleyin.

Özgün adli kaydı korumak için aşağıdaki ayrıntılı PhishDestroy AI analizi İngilizce bırakılmıştır.

PhishDestroy AI

HIGH

The domain nirudex[.]com was a generic phishing site targeting cryptocurrency users with a fraudulent crypto casino scheme. It posed as an 'Elon Musk’s Official Crypto Casino Powered by Blockchain' to deceive victims into depositing funds, though no legitimate brand or drainer kit was confirmed. The site is currently taken offline, but its previous activity classified it as an elevated-risk phishing threat.

Technical indicators for nirudex[.]com include detection by 1 of 95 VirusTotal security vendors, with Gridinsoft assigning a trust score of 100/100. The domain was registered through Global Domain Group LLC on March 04, 2026, and resolved to IP address 172.67.128.163, hosted on Cloudflare’s infrastructure (AS13335). It appeared on 1 security blocklist (PhishDestroy) and used an SSL certificate issued by Let’s Encrypt (E8). The observed page title reinforced its cryptocurrency scam theme, and the HTTP status returned was 666.

Users who interacted with nirudex[.]com should immediately revoke any token approvals granted to the site and transfer remaining funds to a new wallet. Monitor transaction history for unauthorized activity and enable two-factor authentication on all cryptocurrency accounts. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybercrime authorities to aid in takedown efforts.

VirusTotal

14 det.

URLScan

Report ↗

Gridinsoft

1/100

SSL

Yaş

5 mo

Observed status

Active threat 200

DestroyList

Listed

Reports Sent

8 ignored

Veri kapsamı VirusTotal 14 / 91 URLQuery no detections OTX no pulses CF Radar no data URLScan report ready DNS engellemeleri none SSL valid, 86d WHOIS 5 mo old Screenshot yakalanmadı Yönlendirme zinciri not probed Gridinsoft 1/100

Güvenlik Sinyalleri

Gridinsoft Analysis 1 / 100

'', 08 AM 41 AM 7/28 Cryptocurrency Scam Blacklisted Blacklisted by Security Providers Casino Clean

Tehdit Müdahale Pipeline

Discovery

Checks

Reports

Availability

19/20

Önleyici Keşif ve Veri Alımı

Tehdit Alındı

1/1 ✓

Tehdit Alındı

nirudex.com tespit edildi ve kapsamlı analiz için sıraya alındı

Mar 04, 2026

Threat Intelligence Checks

Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · Cloudflare Radar Scan

8/8 ✓

Cloudflare Radar

Scanned via Cloudflare Radar — DNS, certificates & network data

Web Archive

Preserved in Wayback Machine — historical evidence archived

VirusTotal

14 / 91 vendors flagged on VirusTotal

Jul 13, 2026

Google Safe Browsing

Checked via Google Şeffaflık Raporu

Mar 04, 2026

Brand Impersonation

Impersonation of Genericcrypto

Forensic Evidence Collected

Stored evidence from URLScan.io, URLQuery, stored screenshot

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Aug 02, 2026

Cloudflare Radar Scan

Scanned via Cloudflare Radar — network analysis completed

Mar 07, 2026

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · ICANN Escalation #7 · ICANN Escalation #8 · 8 Reports Filed

9/9 ✓

Initial Abuse Report (#1)

Sent to 3 abuse contacts at Global Domain Group LLC with forensic evidence