mrxbet[.]co[.]com

Analysis of the domain mrxbet.co.com indicates active brand impersonation targeting Ethereum users through a fraudulent online casino scheme. The domain, registered on August 16, 1997, via Moniker Online Services LLC, currently resolves to a Cloudflare-hosted endpoint (2a06:98c1:3121::3, AS13335) in the United States. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, Alpine.js, and third-party services such as jsDelivr and Google Analytics, alongside Cloudflare Browser Insights for performance tracking. The SSL certificate is issued by Google Trust Services (WE1), and the domain employs custom nameservers (ns1-4.nic.co.com). The page title, 'Mrxbet Review | Mrxbet Login Link 2025 Welcome Bonus: 100€/$,' explicitly references a 2025 welcome bonus, suggesting an attempt to lure victims with financial incentives.

This aligns with the identified scam type: a crypto scam. Detection data shows the domain is flagged by 2 of 91 security vendors on VirusTotal and appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The HTTP status code 403 indicates the server is actively blocking direct access, a common tactic to evade automated scanning while remaining operational for targeted victims.

Defenders should treat this domain as high-risk. The combination of Cloudflare hosting, a long-standing registration date (potentially repurposed), and explicit crypto-themed lures underscores its deceptive nature. While the exact content of the site remains unanalyzed, the available evidence—including blocklist inclusions, vendor detections, and infrastructure patterns—supports immediate blocking at the DNS or network level. Organizations handling Ethereum-related transactions or user interactions should prioritize monitoring for references to this domain in logs, emails, or social engineering attempts.