gaofax[.]com

The domain gaofax.com was registered on October 25, 2025 through NiceNIC International Group Co., Limited and is currently listed as offline. DNS resolution points to the IP address 188.114.96.3, which belongs to the United States and is announced by AS13335 Cloudflare, Inc. The authoritative name servers are anderson.ns.cloudflare.com and mia.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate is present for the domain, meaning the site would have been served over plain HTTP if it were reachable. The page title indexed from the site reads “Gaofax: Most Popular Online Crypto Casino Based on Blockchain,” and the kit associated with the site has been identified as a Gambler Scam package, consistent with the reported crypto‑scam classification.

The domain is flagged by a single security blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain, providing additional corroboration of its threat profile. PhishDestroy has also blocked the domain, and the overall risk rating has been elevated. The site claims to impersonate the brand x.com, though no visual or functional evidence of the impersonation has been disclosed.

Defenders should continue to block any traffic to gaofax.com at perimeter devices, monitor DNS queries for the domain or its associated IP range, and watch for re‑registration attempts that may reuse the same registrar or hosting provider. Given the use of Cloudflare’s infrastructure and the lack of TLS, threat actors could easily redeploy a similar site under a new domain, so detection rules should incorporate the observed page title, kit name, and the low trust score as indicators of compromise. Continuous review of blocklist entries and periodic VirusTotal rescans are recommended to capture any changes in the domain’s status or detection landscape.