kotarex[.]com

Analysis of kotarex.com indicates a newly registered domain that purports to be an online crypto casino, as reflected in its page title “Kotarex: Most Popular Online Crypto Casino Based on Blockchain.” The domain was created on February 26, 2026 and is registered through NiceNIC International Group Co., Limited. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative name servers are guy.ns.cloudflare.com and kinsley.ns.cloudflare.com, both typical of Cloudflare‑hosted services. No SSL certificate is presented, meaning the site does not serve content over HTTPS, a common characteristic of low‑quality phishing or scam deployments.

The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, suggesting that at least one reputable anti‑phishing organization has identified it as malicious. VirusTotal reports three detections out of ninety‑three scanned engines, providing limited but corroborating evidence of suspicious activity. Gridinsoft assigns the domain a trust score of 1 out of 100, indicating an extremely low confidence in legitimacy. The site is currently taken offline, which limits real‑time observation but does not remove historical risk.

The phishing kit associated with the domain is identified as a “Gambler Scam,” aligning with the casino‑themed narrative and reinforcing the notion of a crypto‑focused fraud. While the exact content served before takedown has not been captured, the convergence of a brand‑like page title, absence of transport‑layer security, low trust rating, and detection by multiple security sources forms a consistent profile of a crypto gambling scam. Defenders should continue to block traffic to the IP address 188.114.97.3, add kotarex.com to domain blocklists, and monitor for any re‑hosting attempts that may arise from the same registrar or Cloudflare infrastructure.