waxcas[.]com

This domain was observed on 23 July 2026 as an offline site that previously advertised a crypto‑focused online casino. The authoritative page title “Waxcas: Most Popular Online Crypto Casino Based on Blockchain” matches the typical branding used by the Gambler Scam phishing kit, which is associated with crypto‑drain scams. Waxcas.com was registered on 6 October 2025 through Dominet (HK) Limited and uses Cloudflare’s DNS service (anna.ns.cloudflare.com, brady.ns.cloudflare.com). DNS resolution points to 172.67.194.157, an address owned by AS13335 Cloudflare, Inc., located in the United States.

The site employed a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake despite the malicious intent. VirusTotal analysis recorded 12 detections out of 93 scanned engines, and the domain appears on at least one security blocklist, currently listed by PhishDestroy. Independent reputation scoring from Gridinsoft assigned a trust score of 1 out of 100, reinforcing the high‑risk assessment. The public record shows no additional intelligence such as Safe Browsing or OTX entries, and the page content has not been captured because the site is offline.

Defenders should immediately add waxcas.com and its resolved IP address 172.67.194.157 to network and email blocklists, monitor for other domains hosted on the same Cloudflare edge, and enforce crypto‑transaction monitoring for any user‑initiated deposits that reference “Waxcas” or similar branding. Continuous threat‑intel feeds should be consulted for any resurgence of the Gambler Scam kit, which frequently reuses compromised domains and may appear under variant names. Because the domain is already taken offline, the primary mitigation focus is on preventing future reuse of the same infrastructure and educating users about unsolicited crypto‑casino invitations.