rozewex[.]com

The domain rozewex.com was observed by threat intelligence feeds on July 25 2026 and is currently listed as offline. Registration records show the domain was created on 1 November 2025 through Dominet (HK) Limited, indicating a relatively recent registration that aligns with typical phishing campaign lifecycles. DNS resolution points to the address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The authoritative name servers are langston.ns.cloudflare.com and paityn.ns.cloudflare.com, both operated by Cloudflare, suggesting the attacker leveraged a reputable CDN to hide the true hosting environment. The site advertised itself as “Rozewex: Most Popular Online Crypto Casino Based on Blockchain,” and the associated scam type is classified as a crypto scam.

No TLS certificate was presented, leaving the connection unencrypted and facilitating credential capture. The page content is identified as using the “Gambler Scam” phishing kit, a known template employed to solicit cryptocurrency deposits from victims. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one industry‑wide mitigation has been applied. Reputation scoring from Gridinsoft assigns a zero‑point trust score (0/100), reflecting a high confidence of malicious intent. VirusTotal analysis returned 11 positive detections out of 95 scanned engines, reinforcing the perception of abuse.

The combination of a fresh registration, lack of TLS, use of a known gambling‑oriented kit, and multiple vendor detections provides a strong indicator that the domain was employed for credential‑phishing or fraud targeting cryptocurrency enthusiasts. Uncertainty remains regarding the volume of victims and whether the infrastructure was repurposed after takedown, as the domain is presently offline. Defensive teams should continue to block any HTTP or DNS resolution attempts to rozewex.