kurenex[.]com

The domain kurenex.com was registered through Hello Internet Corp and created on February 21, 2026. Infrastructure analysis shows it resolves to the IP address 104.21.1.140, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are abdullah.ns.cloudflare.com and kelly.ns.cloudflare.com, both Cloudflare‑managed, indicating use of a reputable DNS provider to obscure the true hosting details. No SSL certificate is present, suggesting the site operated over HTTP only.

The page title observed during the brief collection period was "Kurenex: Elon Musk’s Official Crypto Casino Powered by Blockchain," linking the site to a crypto‑scam narrative that impersonates the brand x.com. Threat actors employed the publicly known Gambler Scam phishing kit, consistent with the crypto casino theme. Detection evidence includes inclusion on a single security blocklist and a block by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent.

VirusTotal scans reported 15 detections out of 93 scanning engines, reinforcing the assessment of hostile behavior. The site is currently offline, but the observed infrastructure—Cloudflare front‑end, lack of TLS, and a brand‑impersonating title—suggests a reusable template that could be redeployed under new domains. Defenders should proactively block the IP 104.21.1.140 and the associated nameserver set, monitor for newly registered domains using the same registrar or similar naming patterns, and incorporate the observed page title and kit fingerprint into URL and content‑based detection rules. Continuous threat‑intel sharing and updating of blocklists are recommended to mitigate reappearance of this campaign.