nezorex[.]com

This domain, nezorex.com, is under investigation for brand impersonation targeting a crypto casino or gambling platform. The site falsely claims affiliation with high-profile figures, specifically advertising itself as 'Elon Musk’s Official Crypto Casino Powered by Blockchain.' No direct evidence of a crypto drainer kit has been identified at this stage, but the domain exhibits characteristics consistent with fraudulent gambling schemes, including the use of tracking technologies such as Twitter Ads and Facebook Pixel to amplify reach and engagement. The impersonation of a well-known public figure and a gambling brand suggests an intent to deceive users into depositing cryptocurrency under false pretenses. Analysis indicates that nezorex.com was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. The domain resolves to the IP address 104.21.46.4, which is associated with Cloudflare’s infrastructure. As of the latest scan, the domain has a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious. However, it appears on two security blocklists, including PhishDestroy and OISD, and is referenced in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Let’s Encrypt, a common but not inherently suspicious provider. Google Safe Browsing status is not explicitly provided, but the presence on multiple blocklists suggests prior detection by other security mechanisms. The domain remains active, and its risk level is currently classified as under investigation. No takedown or sinkholing actions have been reported. The use of Cloudflare complicates attribution and mitigation efforts, as the service masks the origin server and may provide additional anti-bot protections. Users are advised to treat this domain as high-risk, particularly those in regions where online gambling is restricted or regulated. Organizations should consider blocking the domain at the DNS or proxy level, and security teams are encouraged to monitor for related infrastructure, such as subdomains or newly registered lookalike domains. Further analysis is required to determine the full scope of the operation, including any associated cryptocurrency wallets or backend infrastructure.