kefowex[.]com

This domain, kefowex.com, was identified as part of a crypto casino scam infrastructure and has since been taken offline. Registered on October 3, 2025, through Dominet (HK) Limited, the domain resolved to the IP address 172.67.167.166, hosted on Cloudflare's network (AS13335) in the United States. The domain's nameservers were irma.ns.cloudflare.com and quentin.ns.cloudflare.com, consistent with Cloudflare's DNS infrastructure. No SSL certificate was detected for this domain, increasing the likelihood of unencrypted communications between victims and the malicious server. Analysis of the domain's page title, 'Kefowex: Most Popular Online Crypto Casino Based on Blockchain,' indicates it was designed to deceive users into engaging with a fraudulent gambling platform.

The domain was flagged by 12 of 95 security vendors on VirusTotal, suggesting moderate detection coverage. It also appeared on a single security blocklist, further corroborating its malicious classification. The scam type was explicitly categorized as a 'Gambler Scam,' and the presence of a 'Gambler Scam' phishing kit was noted in the available intelligence. Gridinsoft assigned the domain a trust score of 1 out of 100, reflecting a high level of suspicion. The domain was blocked by PhishDestroy and is currently offline, reducing immediate risk to potential victims.

However, defenders should monitor for re-registration or re-emergence under similar domains or infrastructure. Given the use of Cloudflare, which provides anonymity and resilience to takedowns, additional domains leveraging the same hosting provider or registrar may warrant closer scrutiny. No evidence links this domain to a specific legitimate brand, and the exact content or functionality of the site remains unanalyzed beyond the provided page title. Organizations should update blocklists to include this domain and investigate related indicators of compromise, such as the IP address and nameservers, for broader threat hunting.