nelixcas[.]com

Analysis of nelixcas.com indicates it was used for a cryptocurrency casino phishing campaign. The site was registered on October 2, 2025 through Dominet (HK) Limited and resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No TLS certificate is present, confirming the site was served over HTTP only. The page title advertised “Nelixcas: Most Popular Online Crypto Casino Based on Blockchain,” matching the observed scam type of a crypto‑focused gambling lure. The infrastructure was linked to the publicly known “Gambler Scam” phishing kit.

VirusTotal scans recorded 14 detections out of 95 security vendors, confirming the malicious nature of the payload. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole. Trust scoring from Gridinsoft assigned a rating of 1 out of 100, indicating extreme untrustworthiness. Nameserver configuration includes two Cloudflare name servers (michelle.ns.cloudflare.com, paul.ns.cloudflare.com) and two CloudNS entries (pns61.cloudns.net, pns62.cloudns.net). The current HTTP status is offline, suggesting the site has been taken down or is otherwise inaccessible.

Defenders should continue to block the domain at the DNS and proxy layers, enforce outbound filtering to prevent connections to the underlying IP, and monitor for any residual indicators of compromise that reference the Gambler Scam kit. Because the domain was only observed on one blocklist, additional threat‑intel feeds should be consulted to ensure comprehensive coverage. Continuous re‑scanning of the domain, if it reappears, is recommended to capture any changes in detection ratios. Organizations that handle cryptocurrency transactions should be alerted to the specific lure used in this campaign and update user‑education materials accordingly.