xerowex[.]com

The domain xerowex.com was registered on October 02, 2025 through Atak Domain and is currently hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers mcgrory.ns.cloudflare.com and venus.ns.cloudflare.com, and the site presented a Google Trust Services / WE1 SSL certificate, indicating a valid TLS chain but not providing any assurance of legitimacy. The page title observed during analysis reads "Xerowex: Most Popular Online Crypto Casino Based on Blockchain," which aligns with the classification of a crypto‑focused gambling scam. Malware and phishing assessments from VirusTotal show that 14 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity.

Independent tracking by PhishDestroy has taken the site offline, and it appears on at least one public security blocklist. The observed phishing kit is identified as the Gambler Scam package, a known template used to lure victims into fraudulent cryptocurrency gambling operations. No additional threat intelligence sources such as OTX or Google Safe Browsing entries were referenced in the supplied data.

While the domain’s current HTTP status is offline, the underlying infrastructure—Cloudflare IP and valid TLS certificate—remains reusable by threat actors for future campaigns. Defenders should therefore block the domain and its associated IP address at network perimeter devices, update DNS filtering policies to include the observed nameservers, and monitor for any re‑registration attempts or similar domain patterns. Continuous monitoring of VirusTotal and other multi‑engine scanners for re‑emergence is advised, as well as incorporating the Gambler Scam indicator set into intrusion detection signatures to detect re‑used payloads or command‑and‑control traffic linked to this campaign.