geirax[.]com

This domain, geirax.com, is flagged as a crypto scam targeting users with a fraudulent online casino front. Registered on November 10, 2025, through NiceNIC International Group Co., Limited, the site resolves to IP 104.21.10.218, hosted on Cloudflare’s network (AS13335). Infrastructure analysis reveals the domain lacks an SSL certificate, a common red flag for phishing operations, though Cloudflare’s proxy obscures direct server details. The page title, 'Geirax: Most Popular Online Crypto Casino Based on Blockchain,' explicitly indicates a crypto-focused scam, aligning with the 'Gambler Scam' phishing kit classification. Security vendors have detected the domain, with 13 of 95 engines on VirusTotal flagging it as malicious.

It appears on at least one security blocklist and is referenced in two AlienVault OTX threat intelligence pulses, confirming its association with known fraudulent activity. The domain’s trust score from Gridinsoft is 0/100, further supporting its classification as high-risk. Nameservers (DANA.NS.CLOUDFLARE.COM, NILE.NS.CLOUDFLARE.COM) and hosting provider (Cloudflare) are consistent with patterns observed in other phishing campaigns, though Cloudflare’s infrastructure is also used by legitimate services, requiring contextual review. Defenders should treat this domain as confirmed malicious based on its detection history, blocklist presence, and threat intelligence correlations.

While the site is currently offline, historical DNS records and cached content may still pose risks if repurposed or reactivated. No evidence suggests a legitimate use case, and the absence of SSL reinforces its fraudulent nature. Organizations should block the domain at the DNS and proxy levels, monitor for related infrastructure (e.g., subdomains, similar IPs), and alert users to the crypto scam classification. Further investigation into the registrar’s role in domain registration trends for similar scams may provide additional context for proactive defense measures.