spacexplay[.]com

Analysis of spacexplay.com indicates a newly registered domain (created 11 Jan 2026) that is currently offline but was previously detected as part of a crypto‑scam campaign. The site advertised itself with the page title “Spacexplay: Elon Musk’s Official Crypto Casino Powered by Blockchain”, suggesting a brand‑impersonation attempt targeting the SEI brand. The underlying infrastructure uses Cloudflare’s DNS (davina.ns.cloudflare.com, jack.ns.cloudflare.com) and resolves to IP 172.67.204.254, which belongs to AS13335 (Cloudflare, United States). No TLS certificate was observed, meaning the site did not serve HTTPS traffic.

Malware and reputation scans on VirusTotal returned 16 positives out of 93 vendors, and the domain is listed on a single public blocklist and was actively blocked by PhishDestroy. The Gridinsoft trust score of 1/100 further signals a high likelihood of malicious intent. Registration was performed through NiceNIC International Group Co., Limited, a registrar often used by threat actors. The kit identified as “Gambler Scam” aligns with the crypto‑casino narrative in the page title, confirming the classification as a crypto scam.

While the domain is currently taken offline, defenders should continue to monitor the associated IP and Cloudflare name servers for any re‑hosting activity, enforce blocking of the domain and related IP in perimeter defenses, and watch for future registrations that reuse the same branding or kit. Because the site’s content has not been captured, any further technical indicators such as malicious scripts or credential‑harvesting forms remain unknown. Ongoing threat‑intel feeds should be consulted for updates on similar SEI‑impersonation campaigns.