femowex[.]com

On 23 July 2026 the domain femowex.com was identified as a brand‑impersonation site targeting the charitable organization “foundation”. The public page title reads “FEMOWEX | Play at the best online casino based on Blockchain”, which aligns with the reported crypto‑scam kit “Gambler Scam”. Registry data shows the domain was created on 21 February 2026 through Key‑Systems GmbH and is currently listed as offline. DNS resolution points to the IPv6 address 2606:4700:3037::6815:4e07, owned by Cloudflare (AS13335) and geolocated to the United States. Both authoritative nameservers are hosted on Cloudflare (elisabeth.ns.cloudflare.com, nikon.ns.cloudflare.com).

The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS service was in place before the site went dark. An HTTP request to the root returned a 403 status code, suggesting intentional access restriction. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 1 / 100. VirusTotal analysis recorded detections by ten of ninety‑three scanning engines, and the domain appears on one external blocklist.

It has also been flagged in a single AlienVault OTX pulse and is blocked by the PhishDestroy feed. The combination of a brand‑impersonation page title, a gambling‑oriented crypto‑scam kit, low trust scores, and multiple vendor detections indicates a high likelihood of fraudulent activity. Defenders should continue to block femowex.com at DNS and proxy layers, monitor the associated Cloudflare IP range for related activity, and add the domain to internal allow‑list exclusions for legitimate “foundation” communications. Ongoing observation of any re‑registration attempts or changes to the SSL certificate is recommended, as adversaries frequently recycle Cloudflare‑protected infrastructure for new campaigns.