dunegex[.]com

Analysis of dunegex[.]com shows a newly registered domain (created 2026-01-07) that was used to host a crypto‑focused impersonation campaign targeting the Sei brand. The site employed the publicly identified "Gambler Scam" phishing kit and presented a page title reading "Dunegex: Elon Musk’s Official Crypto Casino Powered by Blockchain," which aligns with the reported crypto scam classification. DNS resolution points to IP address 104.21.3.56, an address owned by Cloudflare (AS13335) located in the United States. The SSL certificate issued for the domain is labeled WE1, indicating a standard TLS deployment without additional validation.

Infrastructure reputation is extremely low, with a Gridinsoft trust score of 1 out of 100 and inclusion on a single security blocklist. VirusTotal scans recorded 12 detections out of 95 participating vendors, reinforcing the malicious nature of the host. The domain was flagged and subsequently taken offline, with the blocklist PhishDestroy confirming its removal from active service. Registration was performed through Hello Internet Corp, a registrar frequently observed in malicious registrations.

While the page title and kit provide clear evidence of a crypto‑scam impersonating SEI, the exact page content beyond the title has not been publicly disclosed, leaving the full scope of credential‑stealing mechanisms uncertain. Defenders should immediately block network traffic to both the domain and its resolved IP address, add the host to local and cloud‑based URL filtering lists, and monitor for any residual connections that may attempt to re‑establish communication via the Cloudflare edge. Continuous monitoring of the registrar Hello Internet Corp for related registrations and periodic re‑scanning of the IP address are recommended to detect potential re‑use of the infrastructure for future campaigns.