dongwex[.]com

Analysis of dongwex.com shows a short‑lived domain created on 27 August 2025 that was used to present a fake cryptocurrency casino. The page title “Dongwex: Most Popular Online Crypto Casino Based on Blockchain” explicitly advertises a crypto gambling service, matching the observed scam type of “Crypto Scam” and the identified “Gambler Scam” phishing kit. The domain resolves to the IPv6 address 2a06:98c1:3120::3 and is hosted behind Cloudflare (AS13335, United States). No SSL certificate is presented, indicating the site was served over plain HTTP. Registration was performed through Web Commerce Communications Limited and the authoritative nameservers are clay.ns.cloudflare.com and lara.ns.cloudflare.com.

Reputation services flag the domain as highly malicious. Scamadviser assigns a trust score of 1 / 100, Gridinsoft rates it 0 / 100, and the site appears on one security blocklist. AlienVault OTX includes the domain in a single threat‑intel pulse, and PhishDestroy has listed it as blocked. VirusTotal reports that 13 of 95 scanning engines flagged the domain, reinforcing the malicious classification. The current status is offline, but the historical indicators remain relevant for threat‑intel correlation.

Uncertainty remains about any active infrastructure that may have been reused after takedown, and no further page content has been captured beyond the title. Defenders should immediately add dongwex.com to URL filtering and DNS‑based block lists, monitor for re‑registration of the same name or look‑alike variations, and enforce TLS inspection to detect any future attempts to host similar content without a certificate. Continuous observation of Cloudflare‑associated IP ranges for new phishing kits, especially those leveraging gambler‑style templates, is advised. Correlating logs for outbound connections to the IPv6 address or to the Cloudflare ASN can help identify compromised hosts that may have interacted with the site before it was taken offline.