loxcas[.]com

Analysis of loxcas.com indicates that the domain was registered on 14 April 2025 through Web Commerce Communications Limited. The site resolved to the IPv4 address 69.5.189.58, which is announced by AS42624 Global-Data System IT Corporation and geolocated to Switzerland. Four authoritative name servers – ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com and ns4.nameserverhub – were observed at the time of collection. No TLS certificate was presented, and the HTTP service returned a non‑responsive status because the site has been taken offline.

The page title retrieved before takedown read "LOXCAS | Play at the best online casino based on Blockchain", matching the reported scam type of a crypto‑based gambling operation. The infrastructure matches the "Gambler Scam" phishing kit, a known template used to lure victims into depositing cryptocurrency under the pretense of a blockchain casino. VirusTotal records show that three of ninety‑five scanning engines flagged the domain, providing modest detection confidence. The domain appears on a single security blocklist and is currently listed by PhishDestroy as blocked.

No additional public threat‑intel sources such as Google Safe Browsing or OTX were referenced in the available data. The combination of a recent registration, lack of TLS, association with a gambling‑oriented phishing kit, and modest vendor detections suggests a purposeful but low‑profile campaign targeting cryptocurrency users. Defenders should add the IPv4 address and the domain to network blocklists, monitor for any re‑appearance of the domain or similar name‑server patterns, and apply heuristic rules to flag traffic to newly registered domains that resolve to AS42624. Continuous re‑scanning of the domain with multi‑engine services is advised in case the site is relaunched, and any related phishing emails should be examined for URLs pointing to loxcas.com or its resolved IP.