drenonox[.]com

The domain drenonox.com was registered through NameSilo, LLC and first observed on October 19 2025. DNS resolution points to the IP address 188.114.96.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The authoritative nameservers are moura.ns.cloudflare.com and savanna.ns.cloudflare.com, both belonging to Cloudflare's DNS service. No TLS certificate was detected, indicating that the site operated without HTTPS. The site’s HTML title reads “Drenonox: Most Popular Online Crypto Casino Based on Blockchain,” and the underlying scam kit has been identified as a Gambler Scam, classifying the operation as a crypto‑focused fraud.

The domain explicitly targets the Google Tag Manager brand, suggesting an attempt to deceive users who manage tags on Google services. VirusTotal scanned the host and 13 of 95 security vendors reported a detection, reinforcing the malicious assessment. The domain appears on a single public blocklist, PhishDestroy, which has already taken it offline. Independent analysis from Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the site’s legitimacy. The current HTTP status is offline, confirming that the site is no longer reachable.

While the observed indicators strongly support a malicious profile, no additional intelligence such as URL snapshots, malware payloads, or phishing email samples have been published, leaving the exact user‑facing tactics unverified. Defenders should block the domain and its associated IP at network perimeters, monitor for any residual references in intrusion‑detection signatures, and consider adding the host to internal blocklists. Continuous observation of Cloudflare‑owned IP ranges for similar patterns is advised, as the infrastructure can be reused for future campaigns.