tagewex[.]com

The domain tagewex.com was observed as part of a brand‑impersonation campaign targeting the x.com brand. The site is currently offline, returning an HTTP 403 status, and its hosting resolves to the Cloudflare edge address 104.21.31.93, which is advertised as belonging to AS13335 Cloudflare, Inc., located in the United States. Registration data show the domain was created on 21 February 2026 and was registered through Hello Internet Corp, indicating a recent establishment typical of short‑lived phishing infrastructure. The authoritative name servers are lee.ns.cloudflare.com and opal.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

TLS termination is provided by a Let’s Encrypt certificate (E8), a common choice for actors seeking inexpensive, automated encryption. Malware analysis reports associate the site with the Gambler Scam phishing kit, and the campaign is classified as social‑media phishing, suggesting the malicious page was designed to harvest credentials via a platform‑based lure. Reputation data indicate a Gridinsoft trust score of 0 / 100 and that the domain appears on one security blocklist. It has been flagged by PhishDestroy and detected by 13 of 93 security vendors on VirusTotal, demonstrating moderate detection coverage.

While the page title is simply "tagewex.com," no additional content has been publicly disclosed, leaving the exact visual mimicry unknown. Defenders should add the domain and its associated IP address to blocklists, monitor DNS queries for the listed Cloudflare name servers, and enforce strict URL filtering for any URLs resolving to 104.21.31.93. Given the low trust score and existing blocklist presence, proactive denial of traffic to this host is advisable. Continuous re‑evaluation is recommended in case the infrastructure is re‑hosted or the domain is re‑activated.