keiwex[.]com

Analysis indicates that the domain keiwex.com was registered on February 21 2026 through NiceNIC International Group Co., Limited and immediately pointed to Cloudflare infrastructure (nameservers dilbert.ns.cloudflare.com and maya.ns.cloudflare.com). DNS resolution maps the hostname to IP 172.67.184.126, which belongs to AS13335 owned by Cloudflare, Inc., placing the server in the United States. The site presented the page title “Keiwex: Elon Musk’s Official Crypto Casino Powered by Blockchain,” suggesting an attempt to lure victims with a fabricated endorsement from Elon Musk and a cryptocurrency casino narrative. Detection services have flagged the domain: twelve of ninety‑five VirusTotal scanners raised alerts, and the site is listed on a single public blocklist.

It has been blocked by the PhishDestroy service. Technical fingerprints show the presence of Twitter Ads, Facebook Pixel, Cloudflare Browser Insights, and generic Cloudflare services, all typical of a credential‑harvesting landing page. The observed phishing kit is identified as the “Gambler Scam,” and the overall scam type is classified as a crypto scam. No SSL certificate was observed, indicating that the site operated without HTTPS.

Current HTTP status is offline, confirming that the malicious page has been taken down. Uncertainties remain regarding the volume of victim interaction, the specific payload delivered, and whether any cryptocurrency wallets were compromised. Defenders should continue to block keiwex.com at DNS and proxy layers, monitor for any re‑hosting attempts on other Cloudflare IP ranges, and update threat‑intel feeds with the observed indicators of compromise, including the domain name, IP address, registrar, and detected tracking scripts. Additional surveillance of related Gambler Scam campaigns is recommended to capture any resurgence of the same infrastructure.