berofex[.]com

On July 24, 2026, berofex.com was identified as a crypto‑casino phishing site. The domain was registered on November 19, 2025 by MAT BAO CORPORATION and resolves to the IPv6 address 2606:4700:3034::ac43:a0d8, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The site used the page title “Berofex: Most Popular Online Crypto Casino Based on Blockchain,” indicating an attempt to lure victims seeking cryptocurrency gambling services. No TLS certificate was observed, and the site operated without HTTPS. Nameserver records point to HALEY.NS.CLOUDFLARE.COM and HARLEY.NS.CLOUDFLARE.COM, confirming Cloudflare as the DNS provider.

Reputation checks show extremely low trust: Gridinsoft assigned a score of 1 / 100 and Scamadviser also gave 1 / 100. The domain has been flagged by multiple security engines; VirusTotal recorded ten detections out of ninety‑five scanners, and PhishDestroy listed it as blocked. It appears on a single security blocklist and is referenced in one AlienVault OTX pulse. The underlying malicious kit is identified as a Gambler Scam, and the operational classification is a crypto‑scam.

The site’s current HTTP status is offline, suggesting the operator has taken the infrastructure down, but the infrastructure components remain active and may be repurposed. Defenders should add the domain and its IPv6 address to outbound filtering rules, monitor the associated Cloudflare nameservers for any re‑registration, and incorporate the indicator set into threat‑intel feeds. Continuous observation of DNS and SSL changes is advised, as the lack of a certificate could be rectified in future campaigns. The elevated risk rating reflects the combination of low trust scores, confirmed phishing kit, and multiple vendor detections.