nebofex[.]com

Analysis of nebofex.com, registered on February 21 2026 through Hello Internet Corp, shows a short-lived infrastructure that was taken offline before the report date of July 23 2026. The domain resolves to the IPv6 address 2606:4700:3036::ac43:acc9, a Cloudflare edge server identified as AS13335 (Cloudflare, Inc.) located in the United States. Nameserver records point to algin.ns.cloudflare.com and magali.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate was observed for the site, indicating that any HTTP traffic would have been unencrypted. The page title retrieved during the brief online period was "Nebofex: Elon Musk’s Official Crypto Casino Powered by Blockchain," which ties the site to a crypto‑focused scam narrative. The content explicitly impersonates the TON brand, matching the declared brand target of "ton" and the broader classification of a crypto scam.

Threat intelligence feeds indicate the domain appears on one security blocklist and was blocked by PhishDestroy. VirusTotal scans reported 13 detections out of 93 security vendors, reinforcing the malicious assessment. The Gridinsoft trust score of 0 / 100 further reflects a lack of legitimacy. The phishing kit identified as "Gambler Scam" aligns with the casino‑themed page title and suggests a template designed to lure cryptocurrency‑interested victims.

Given the absence of an SSL certificate, the reliance on Cloudflare’s infrastructure, and the confirmed detections, defenders should continue to treat nebofex.com as malicious. Network security controls should block traffic to the IPv6 address 2606:4700:3036::ac43:acc9 and to the domain itself. Endpoint and email security solutions should incorporate the domain and its associated indicators into their blocklists, and threat‑intel sharing platforms should be updated with the observed characteristics to aid in rapid detection of any re‑use of the underlying infrastructure.