womtexx[.]com

This domain, womtexx.com, was registered on August 30 2025 through NiceNIC International Group Co., Limited and resolved to the Cloudflare edge address 172.67.220.204 (AS13335, United States). The site presented the page title “Womtexx: Most Popular Online Crypto Casino Based on Blockchain” and was classified as a crypto‑scam impersonating the legitimate brand x.com. No TLS certificate was observed, indicating the site operated without HTTPS protection. Cloudflare nameservers isaac.ns.cloudflare.com and rafe.ns.cloudflare.com were listed, confirming the use of the Cloudflare CDN for hosting.

Malware and phishing detection services flagged the domain; VirusTotal reported 7 of 95 security vendors as positive, and the site was listed on at least one external blocklist and actively blocked by PhishDestroy. The Gridinsoft trust score of 1/100 further reflects a high likelihood of malicious intent. The phishing kit identified as “Gambler Scam” aligns with the cryptocurrency casino theme. As of the report date, the domain has been taken offline, but the infrastructure—especially the use of Cloudflare’s network and the absence of SSL—remains a potential indicator for future re‑hosting.

Defenders should continue to monitor the domain’s DNS records for any re‑activation, add the IP address 172.67.220.204 to deny‑list rules where appropriate, and include womtexx.com in brand‑monitoring feeds for x.com. Correlation with other Gambler Scam kit deployments may reveal additional campaign infrastructure. At present, no further technical artefacts such as payload samples or URL structures have been disclosed, so the precise attack vector remains uncertain.