raomex[.]com

Analysis of raomex.com shows a newly registered domain (created 29 September 2025) that was used to host a crypto‑casino impersonation campaign targeting the brand x.com. The site presented the page title "Raomex: Most Popular Online Crypto Casino Based on Blockchain" and is associated with a Gambler Scam phishing kit. Infrastructure inspection reveals the domain resolves to IP 172.67.149.52, hosted on Cloudflare (AS13335) in the United States, and uses the Cloudflare nameservers anderson.ns.cloudflare.com and fay.ns.cloudflare.com. No SSL certificate was observed, indicating an unsecured HTTP service at the time of capture.

Reputation data is poor: Gridinsoft assigned a trust score of 0 / 100, and four of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on a single security blocklist and was blocked by the PhishDestroy sinkhole. Registration details list NiceNIC International Group Co., Limited as the registrar.

Current monitoring indicates the site has been taken offline, but the historical artifacts suggest a short‑lived but active impersonation effort. Defenders should update URL filtering rules to block raomex.com and any sub‑domains, enforce TLS inspection to capture any future clear‑text traffic, and add the observed IP address 172.67.149.52 to deny‑list entries for outbound connections. Threat‑intel feeds should be refreshed with the domain’s indicators of compromise, and incident response teams should search for any authentication attempts or credential submissions directed at x.com that might have been captured during the campaign’s active window.