ronex[.]cc

Analysis of ronex.cc indicates a deliberately crafted crypto‑casino phishing operation. The site’s public page title, "Ronex: Most Popular Online Crypto Casino Based on Blockchain," aligns with the declared scam type of a crypto scam and the identified phishing kit labeled as a Gambler Scam. DNS resolution points to the IP address 172.67.137.181, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The domain was registered on August 29, 2025 through Web Commerce Communications Limited and uses Cloudflare nameservers stella.ns.cloudflare.com and tanner.ns.cloudflare.com. No TLS certificate was observed, meaning the site was served without HTTPS protection.

Security‑vendor intelligence shows the domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal scans recorded 15 detections out of 93 scanners, reinforcing malicious intent. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of abuse. Current infrastructure status is offline, so active exploitation is not observable, but historical artifacts remain relevant for threat‑intel correlation.

Defenders should continue to block the domain at perimeter devices, update URL filtering rules to include ronex.cc, and monitor for any re‑hosted content that may reuse the same IP range or nameserver configuration. Incident response teams should also consider the associated IP address 172.67.137.181 as potentially shared with other malicious actors hosted behind Cloudflare, and apply appropriate network‑level controls. The lack of an SSL certificate suggests that any future re‑activation would likely continue to operate over plaintext HTTP, making it easier to detect via DPI. Overall, the evidence points to a confirmed crypto‑casino phishing campaign that should be treated as elevated risk until the infrastructure is fully remediated.