hesodex[.]com

The domain hesodex.com was registered on 29 October 2025 through Dominet (HK) Limited. It resolves to the Cloudflare edge address 104.21.32.84 (AS13335, United States). Both authoritative nameservers are hosted by Cloudflare (jen.ns.cloudflare.com, yevgen.ns.cloudflare.com). No TLS certificate was observed, and the site currently returns no HTTP response because it has been taken offline. The page title retrieved during the brief presence of the site read “Hesodex: Most Popular Online Crypto Casino Based on Blockchain”, matching the declared scam type of a crypto casino phishing campaign.

Analysis of the site’s infrastructure identified the use of the publicly available “Gambler Scam” phishing kit, a toolkit commonly employed to harvest cryptocurrency credentials. VirusTotal scans recorded 12 positive detections out of 95 security vendors, indicating that a minority of scanners flagged the domain as malicious. The site is listed on one security blocklist and has been explicitly blocked by the PhishDestroy service. Independent trust scoring (Gridinsoft) assigned a rating of 1 out of 100, reflecting an extremely low reputation.

Because the site is offline, direct verification of the phishing page content, credential‑stealing forms, or redirect behavior is not possible; thus the full scope of the malicious payload remains uncertain. Defenders should continue to block the domain and its resolving IP address at perimeter filters, add the host to internal threat‑intel feeds, and monitor related Cloudflare‑hosted sub‑domains for re‑use. Ongoing observation of the registrar and nameserver configuration is recommended, as adversaries frequently re‑register takedown‑ed domains to resume operations. In summary, hesodex.com exhibits multiple high‑confidence indicators of a crypto‑focused phishing campaign and should be treated as a confirmed malicious resource.