app[.]beacox[.]com

This domain app.beacox.com was observed on 23 July 2026 delivering a phishing page that advertises a crypto‑casino service. The site resolves to the IPv4 address 104.21.46.16, which is announced by AS399629 BL Networks and geolocated to Romania. Authoritative name servers dax.ns.cloudflare.com and lana.ns.cloudflare.com indicate the hosting is provided through Cloudflare’s network. The web server returns an HTTP 308 permanent redirect status, and the TLS certificate is issued by Let’s Encrypt to the identifier YE2, confirming the use of a publicly‑available certificate rather than a brand‑specific one. The page title “Beacox: Most Popular Online Crypto Casino Based on Blockchain” aligns with the “Gambler Scam” phishing kit previously catalogued by security researchers, suggesting the campaign is targeting cryptocurrency gambling enthusiasts.

Registration data shows the domain was created on 30 May 2026 by Fewmoretaps OU operating under the trade name Trustname.com. VirusTotal analysis recorded 14 positive detections out of 91 scanned engines, and the domain appears on a single external blocklist. Gridinsoft’s trust score of 0 / 100 further reflects a lack of legitimacy. The domain is currently listed as blocked by the PhishDestroy service.

While the available intelligence confirms the infrastructure and the use of a known gambling‑related phishing kit, the exact phishing flow (e.g., credential‑stealing forms or malicious downloads) has not been publicly disclosed. Defenders should treat app.beacox.com as a high‑risk indicator and add it to network‑level blocklists, enforce DNS filtering, and monitor for outbound connections to 104.21.46.16. Endpoint protection solutions should be updated to flag the 14 VirusTotal detections, and organizations handling cryptocurrency or gambling‑related accounts should educate users about the deceptive branding.