⚠️

Цей домен було позначено як шкідливий

Detected by 11 security vendors. Exercise extreme caution — do not enter personal information or connect wallets. Створити офіційний лист-скаргу, підготовлений за допомогою штучного інтелекту, для подання до органів, що займаються боротьбою з кіберзлочинами.

REGISTRAR NEGLIGENCE · EGREGIOUS Global Domain Group LLC was notified 3 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-04-04 21:06:46 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 8 times, most recently 2026-04-04 21:06:46 UTC) to abuse@verisign-grs.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 3 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If Global Domain Group LLC doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 8 separate notifications over 3 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

3 months

Reports sent

Latest case ID

PD-20260404-D39625

Current status

Serving traffic (alive)

levopex[.]com

Звіт про безпеку доменів та аналіз загроз

“Levopex: Elon Musk’s Official Crypto Casino Powered by Blockchain”

11/91 VT Active threat Apr 05, 2026 Genericcrypto Шахрайство з азартними іграми Social Media Phishing 8 Reports Sent

CA + more

88 Оцінка ризику

Локалізований огляд звіту

levopex.com: виявлення VirusTotal — 11/91. Перевірте DNS, SSL, реєстратора, блок-листи й докази загроз.

Докладний аналіз PhishDestroy AI нижче залишено англійською, щоб зберегти оригінальний криміналістичний запис.

PhishDestroy AI

HIGH

Analysis of levopex[.]com shows a high‑risk, active phishing infrastructure targeting cryptocurrency gambling users. The domain was registered on April 04, 2026 through Global Domain Group LLC and resolves to Cloudflare‑hosted IP 188.114.96.3 in Canada, using the Cloudflare nameservers eve.ns.cloudflare.com and isaac.ns.cloudflare.com. The site presents the page title "Levopex: Elon Musk’s Official Crypto Casino Powered by Blockchain," indicating an attempt to impersonate a crypto casino brand. Technical fingerprints include Twitter Ads, Facebook Pixel, Cloudflare Browser Insights, and a Let’s Encrypt/E8 TLS certificate, all typical of malicious pages designed to blend with legitimate advertising ecosystems. VirusTotal scans have flagged the domain by 14 of 94 security vendors, and Gridinsoft assigns a trust score of 88/100, underscoring its malicious nature. The operation is classified as a social media phishing campaign employing a known Gambler Scam kit. It is already blocked by PhishDestroy and appears on one external blocklist, but the HTTP response remains 200, confirming the site is serving content. Defenders should immediately add levopex[.]com to network and endpoint blocklists, monitor DNS queries for the associated Cloudflare IP range, and educate users about unsolicited crypto casino promotions. Continuous monitoring is advised to detect any pivoting of the infrastructure or emergence of new indicators.

VirusTotal

11 det.

URLScan

Report ↗

Gridinsoft

1/100

SSL

Let's Encrypt

Вік

4 mo

Observed status

Active threat 200

DestroyList

Listed

Reports Sent

8 ignored

Обсяг даних VirusTotal 11 / 91 URLQuery no detections OTX no pulses CF Radar suspicious URLScan report ready Блокування DNS none SSL valid, 44d WHOIS 4 mo old Screenshot не зафіксовано Ланцюжок перенаправлень not probed Gridinsoft 1/100

Процес реагування на загрози Pipeline

Discovery

Checks

Reports

Availability

18/19

Попереднє виявлення та імпорт даних

Загроза виявлена

1/1 ✓

Загроза виявлена

levopex.com виявлено та додано до черги для повного аналізу

Apr 05, 2026

Threat Intelligence Checks

Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · VT Detection +12

8/8 ✓

Cloudflare Radar

Scanned via Cloudflare Radar — DNS, certificates & network data

Web Archive

Preserved in Wayback Machine — historical evidence archived

VirusTotal

11 / 91 vendors flagged on VirusTotal

Jul 28, 2026

Google Safe Browsing

Checked via Звіт Google про прозорість

Jun 26, 2026

Brand Impersonation

Impersonation of Genericcrypto

Forensic Evidence Collected

Stored evidence from URLScan.io, URLQuery, stored screenshot

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Aug 01, 2026

VT Detection +12

+12 new detections (2 → 14): ADMINUSLabs, BitDefender, CRDF, Chong Lua Dao +8

Jun 26, 2026

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · ICANN Escalation #8 · 7 Reports Filed

8/8 ✓

Initial Abuse Report (#1)

Sent to 3 abuse contacts at Global Domain Group LLC with forensic evidence