clarix[.]cc

As of July 24 2026, clarix.cc is identified as a brand‑impersonation phishing domain. The site presented the page title "Clarix: Most Popular Online Crypto Casino Based on Blockchain", indicating an attempt to lure victims interested in cryptocurrency gambling. Infrastructure analysis reveals that the domain resolves to 172.67.178.160, an address owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative name servers, guy.ns.cloudflare.com and holly.ns.cloudflare.com, are hosted by Cloudflare, confirming the use of Cloudflare’s DNS and reverse‑proxy services. The TLS certificate is issued by Let’s Encrypt (E8) and therefore appears valid, which can increase user trust.

The domain was registered on March 19 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known to host a variety of short‑lived malicious registrations. Threat intelligence sources report that the site employed the Gambler Scam phishing kit, a known template targeting crypto‑casino users. Eight of ninety‑one VirusTotal scanners flagged the domain, reflecting moderate detection across security vendors. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole.

Current HTTP probing shows the site is taken offline, but the historical evidence remains relevant for detection rules. Defenders should continue to block clarix.cc at DNS and proxy layers, monitor traffic to its hosting IP 172.67.178.160 for any residual activity, and consider adding the domain to internal blocklists. Because the SSL certificate is trusted, traditional certificate‑based whitelisting may not be sufficient; behavior‑based detection and reputation checks are recommended. Ongoing observation of the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED for new registrations with similar patterns is also advised.