nefodex[.]com

This domain, nefodex.com, was registered on 27 October 2025 through Dominet (HK) Limited and is currently resolved to 172.67.222.94, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented the page title "Nefodex: Most Popular Online Crypto Casino Based on Blockchain," indicating a crypto‑casino lure. Analysis by multiple security vendors shows that 12 of 95 scanners on VirusTotal flagged the domain, and AlienVault OTX references it in two separate threat pulses. The domain is listed on one public blocklist and has been actively blocked by the PhishDestroy service. Reputation services assign it a Gridinsoft trust score of 1 out of 100, and the only known phishing kit associated with the infrastructure is the "Gambler Scam" kit, a known template used to harvest cryptocurrency credentials.

The domain lacks an SSL/TLS certificate, suggesting it was served over plain HTTP at the time of observation. Nameserver records point to paige.ns.cloudflare.com and pedro.ns.cloudflare.com, both Cloudflare‑managed. The site’s current status is offline, and the hosting provider’s use of Cloudflare obscures the true origin server. Evidence indicates that nefodex.com was employed as a crypto‑scam phishing vector rather than a legitimate gambling service.

However, the underlying backend server behind the Cloudflare edge has not been identified, and no additional landing pages have been captured, leaving the full scope of the campaign uncertain. Defenders should block traffic to both the domain and its resolved IP address, add the nameservers to watch lists, and monitor for any re‑registration attempts. Continuous feed updates from PhishDestroy, VirusTotal, and AlienVault OTX are recommended to capture any resurgence. Given the low trust score, lack of encryption, and association with a known gambling‑scam kit, the domain should be treated as malicious and excluded from allowed lists.