derunex[.]com

This domain, derunex.com, is actively engaged in brand impersonation targeting users of crypto casino and gambling platforms. Analysis confirms the domain is designed to mimic legitimate gambling services, specifically leveraging the name of Elon Musk to lend false credibility. The threat type is classified as a phishing scam, with the primary objective of harvesting user credentials, financial information, or cryptocurrency deposits under fraudulent pretenses. As of the latest assessment, the domain remains active and operational. Infrastructure analysis reveals the following technical indicators: derunex.com is flagged by 16 of 95 security vendors on VirusTotal, indicating a moderate to elevated risk profile. The domain was registered on May 16, 2024, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. It resolves to the IPv6 address 2a06:98c1:3120::3 and is protected by a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. The domain appears on one security blocklist and is blocked by PhishDestroy. Detected technologies include Twitter Ads, Facebook Pixel, and Cloudflare Browser Insights, suggesting a coordinated effort to drive traffic through social media and advertising platforms. The presence of a Gambler Scam phishing kit further corroborates the malicious intent. The current status of derunex.com is active, and the risk level is classified as elevated due to its sophisticated impersonation tactics and integration with social engineering vectors. Organizations and individuals are advised to block access to this domain at the network level, including its associated IP address. End-users should be alerted to the fraudulent nature of the site, particularly those involved in cryptocurrency or online gambling. Security teams are recommended to monitor for related domains registered through Fewmoretaps OU or resolving to the same IP range, as these may indicate further campaign expansion. Immediate reporting to relevant anti-fraud and cybersecurity authorities is encouraged to mitigate the spread of this phishing operation.