vexalta[.]pro

Analysis of vexalta.pro indicates that the domain is being used to host a crypto‑related gambling scam. The site resolves to the IPv6 address 2606:4700:3033::6815:2b20, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Registration details show the domain was provisioned through Cloudflare’s registrar service, and the authoritative name servers are desi.ns.cloudflare.com and jakub.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, confirming the use of a valid, publicly trusted certificate.

VirusTotal scans have returned 13 positive detections out of 95 security vendors, confirming malicious classification by multiple engines. The domain is listed on PhishDestroy and appears on at least one additional security blocklist. AlienVault OTX references the domain in a single threat‑intel pulse, further corroborating its association with malicious activity. Gridinsoft assigns a trust score of 1 out of 100, indicating extreme risk.

The page title “Vexalta: Most Popular Online Crypto Casino Based on Blockchain” and the identified phishing kit labeled “Gambler Scam” suggest that the actor is attempting to lure victims into a cryptocurrency casino façade, a known vector for financial theft. The current operational status is offline, but the elevated risk rating and the infrastructure components (Cloudflare‑hosted IP, reputable SSL, and low trust score) imply that the site could be re‑activated or cloned under a similar naming pattern. Defenders should continue to block the IPv6 address and the domain at DNS and proxy layers, add vexalta.pro to local blocklists, and monitor for newly registered domains that use the same name‑server pair or similar “vexalta” branding. Threat‑intel feeds should be updated with the observed indicators, and incident response teams should be alerted to potential phishing attempts targeting cryptocurrency users.