zenixpro[.]cc

Analysis of zenixpro.cc shows a confirmed phishing operation targeting cryptocurrency casino users. The site, now taken offline, was created on December 06, 2025 and is registered through NiceNIC International Group Co., Limited. Infrastructure inspection reveals that the domain resolves to IP address 104.21.25.193, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Both authoritative nameservers, BILL.NS.CLOUDFLARE.COM and DAVINA.NS.CLOUDFLARE.COM, confirm the use of Cloudflare’s DNS service. No TLS certificate was observed, indicating the site was served without HTTPS protection.

The page title retrieved from the site – "Zenixpro: Most Popular Online Crypto Casino Based on Blockchain" – aligns with the declared scam type of a crypto scam and matches the Gambler Scam phishing kit identified in the intelligence. The domain is listed on a single security blocklist and has been blocked by PhishDestroy. Additionally, AlienVault OTX references the domain in one threat‑intelligence pulse, providing further corroboration of malicious intent. The Gridinsoft trust score of 1 out of 100 underscores the low reputation of the host.

VirusTotal scans flagged the domain in 16 of 95 security engines, reinforcing the detection consensus. While the site is currently offline, defenders should continue to monitor DNS queries for the domain and its associated IP, enforce blocklisting in perimeter security devices, and update web‑filtering policies to deny any future resolution. Logging of outbound connections to Cloudflare‑hosted IPs linked to this domain is advised, as is the inclusion of the domain in threat‑intel feeds to pre‑empt re‑hosting attempts. The lack of SSL and the use of a known gambling‑related phishing kit suggest a low‑cost, copy‑and‑paste deployment, but the presence of multiple independent detections indicates a non‑trivial threat to cryptocurrency‑focused users.