riovex[.]com

The domain riovex.com was registered on February 21, 2026 and is presently taken offline. Infrastructure analysis shows it resolves to IP address 104.21.19.202, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented an SSL certificate identified as WE1, indicating that TLS was in use at the time of observation. The page title retrieved from the site reads "Riovex: Most Popular Online Crypto Casino Based on Blockchain," which aligns with the reported scam type of a crypto casino.

The domain is explicitly linked to a brand impersonation campaign targeting x.com, as indicated by the intelligence that it impersonates the x.com brand. Detection services on VirusTotal flagged the domain in 16 of 93 security vendor scans, suggesting a moderate level of consensus among scanners that the site is malicious. The domain appears on a single security blocklist and has been blocked by PhishDestroy, confirming that at least one protective service has taken action against it. AlienVault OTX recorded the domain in one threat intelligence pulse, providing additional corroboration of its malicious nature.

The phishing kit associated with the site is labeled as a Gambler Scam, which is consistent with the casino‑themed page title and the crypto‑focused lure. While the domain is currently offline, defenders should continue to monitor the IP address 104.21.19.202 for any re‑use in future campaigns, enforce blocklist entries for riovex.com across web filtering solutions, and update detection signatures to include the observed SSL certificate identifier and page title text. Organizations should also educate users about unsolicited offers of crypto casino services that claim affiliation with well‑known brands such as x.com, as these are typical vectors for credential harvesting and financial fraud.