xpcas[.]com

Analysis of xpcas.com indicates a confirmed crypto scam domain targeting users with a fraudulent gambling platform falsely branded as 'Elon Musk’s Official Crypto Casino Powered by Blockchain.' The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and is associated with the Gambler Scam phishing kit. Infrastructure analysis reveals the domain resolves to IP address 172.67.162.181, hosted on Cloudflare’s network (AS13335) in the United States, a common pattern observed in scam operations leveraging Cloudflare’s proxy services to obscure origin servers. The domain is flagged by 16 of 93 security vendors on VirusTotal, a detection rate consistent with known phishing and scam activity. It appears on at least one security blocklist, including PhishDestroy, and holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification.

No SSL certificate is present, which is atypical for legitimate financial or gambling platforms and increases the risk of credential interception. Nameservers norm.ns.cloudflare.com and venus.ns.cloudflare.com confirm Cloudflare’s infrastructure is in use, though this alone does not distinguish malicious from benign domains. At the time of this report, xpcas.com has been taken offline, though historical records and detection data remain relevant for threat hunting and defensive measures.

Defenders should treat this domain as a confirmed threat, block it at the DNS and network levels, and monitor for related infrastructure, including IP 172.67.162.181 and other domains associated with the Gambler Scam kit. The absence of SSL and the use of a high-profile brand name (Elon Musk) in the page title are strong indicators of fraudulent intent. Further investigation into the registrar and hosting provider may yield additional linked domains or infrastructure, though no direct evidence of registrar abuse is present in current data.