buorax[.]com

Analysis of buorax.com indicates this domain was actively used for a crypto-based gambling scam impersonating x.com, as evidenced by infrastructure and detection data collected prior to its takedown. The domain was registered on October 16, 2025, through NiceNIC International Group Co., Limited, and utilized Cloudflare nameservers (haley.ns.cloudflare.com and wesley.ns.cloudflare.com) alongside Cloudflare hosting (AS13335) resolving to 172.67.159.208 in the United States. No SSL certificate was present at the time of assessment, increasing the risk of unencrypted data transmission. The page title, 'Buorax: Most Popular Online Crypto Casino Based on Blockchain,' explicitly describes the scam type, aligning with the 'Gambler Scam' phishing kit classification.

Detection vendors flagged the domain with high-risk scores: Scamadviser and Gridinsoft both assigned a trust score of 1/100, and the domain appeared on at least one security blocklist. PhishDestroy blocked the domain, and eight of the 95 security vendors on VirusTotal detected it as malicious. The absence of an SSL certificate and the use of Cloudflare infrastructure are consistent with tactics observed in phishing campaigns seeking to obscure hosting origins while maintaining low operational costs. Defenders should treat buorax.com as a confirmed phishing domain targeting users of x.com, likely through deceptive promotions or fraudulent investment schemes tied to cryptocurrency gambling.

While the domain is currently offline, historical DNS and detection data remain relevant for retrospective threat hunting. Security teams are advised to monitor for related infrastructure, such as domains registered through the same registrar or utilizing identical nameserver patterns, and to update blocklists accordingly. The exact content of the phishing page has not been analyzed, but the available evidence confirms its classification as a crypto scam.