haepux[.]com

This domain, haepux.com, is identified as a brand impersonation threat targeting online crypto gambling platforms. Analysis indicates the domain mimics a legitimate blockchain-based casino, using the page title 'Haepux: Most Popular Online Crypto Casino Based on Blockchain' to deceive users into engaging with fraudulent services. The domain does not appear to deploy a crypto drainer kit but focuses on luring victims through brand deception, likely for financial fraud or credential harvesting. Infrastructure analysis reveals multiple technical indicators of compromise. The domain is flagged by 13 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 1/100 and a Scamadviser trust score of 1/100. It was registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.97.3, which is linked to Cloudflare infrastructure, a common obfuscation tactic used by threat actors. It appears on one security blocklist and is currently blocked by PhishDestroy. Technologies detected include Twitter Ads, Facebook Pixel, and Cloudflare Browser Insights, suggesting an attempt to amplify reach through social media and ad networks. As of the latest assessment, haepux.com has been taken offline, reducing immediate exposure to potential victims. However, the elevated risk level persists due to the domain's historical activity and the likelihood of re-emergence under a similar or altered infrastructure. Organizations and users are advised to monitor for related domains registered through the same registrar or resolving to the same IP range. Blocking the IP address 188.114.97.3 and implementing real-time threat intelligence feeds for domains associated with NICENIC INTERNATIONAL GROUP CO., LIMITED can mitigate residual risk. Users should verify the legitimacy of crypto gambling platforms through official channels and avoid engaging with domains flagged by multiple security vendors.