xerogex[.]com

Analysis of xerogex.com shows a newly registered domain created on 21 February 2026 through Hello Internet Corp. The domain resolves to 172.67.152.20, an address owned by AS13335 Cloudflare, Inc., indicating the use of a widely‑available content‑delivery network to hide the true hosting location. The SSL certificate presented is identified as WE1, which is typical for Cloudflare‑issued certificates and does not provide unique ownership information. The site title retrieved before takedown reads “Xerogex: Elon Musk’s Official Crypto Casino Powered by Blockchain,” and the domain is explicitly listed as impersonating x.com, the primary brand of Elon Musk’s payment and crypto platform. The campaign is classified as a crypto‑scam and is associated with the publicly available “Gambler Scam” phishing kit.

Reputation checks show the domain is flagged by 11 of 93 VirusTotal scanners, appears on a single security blocklist, and has been added to one AlienVault OTX pulse. PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of 1 out of 100, reflecting extreme suspicion. The current HTTP status is offline, preventing live verification of the page content. While the page title and kit attribution confirm a brand‑impersonation attempt targeting users of x.com, no public evidence of credential harvesting or payment redirection has been released.

Defenders should continue to block xerogex.com at DNS and proxy layers, monitor for any resurgence of the same IP or SSL fingerprint, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of Cloudflare‑hosted infrastructure linked to this certificate may reveal additional malicious domains that reuse the same kit. Until the site is re‑hosted, investigators should treat the domain as a high‑confidence impersonation vector and apply appropriate mitigations.