truvex[.]cc

Analysis of truvex.cc shows an active generic phishing campaign classified as a Gambler Scam with brand impersonation. The site resolves to the Cloudflare‑managed address 172.67.159.59, located in Canada, and uses Cloudflare’s nameservers kellen.ns.cloudflare.com and sunny.ns.cloudflare.com. Registration occurred on 20 April 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED, and the TLS certificate is issued by Google Trust Services (WE1). The page title advertises “Truvex: Most Popular Online Crypto Casino Based on Blockchain,” indicating an attempt to lure victims into a crypto‑casino narrative. Threat intelligence indicates the domain appears in one AlienVault OTX pulse, carries a Gridinsoft trust score of 0 / 100, and is flagged by 14 of 91 security vendors on VirusTotal. It is listed on a single public blocklist and has been blocked by PhishDestroy. While the exact phishing landing page content has not been examined, the presence of a known Gambler Scam kit and brand‑impersonation labeling suggest credential‑harvesting or financial fraud intent. Defenders should immediately block DNS resolution for truvex.cc, add the IP 172.67.159.59 to outbound traffic denial lists, and monitor for any internal requests to Cloudflare edge nodes associated with this address. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to the same Cloudflare tenant, and endpoint security solutions should be updated to recognize the 14 vendor detections associated with this domain.