keonax[.]com

Analysis of keonax.com, created on October 03, 2025 and registered through NiceNIC International Group Co., Limited, reveals a high‑confidence crypto‑scam infrastructure. The domain resolves to IP address 172.67.160.92, which is hosted by Cloudflare (AS13335) in the United States and is served by the nameservers georgia.ns.cloudflare.com and matias.ns.cloudflare.com. No SSL certificate is presented, indicating unencrypted HTTP service at the time of observation. The site’s page title, "Keonax: Most Popular Online Crypto Casino Based on Blockchain," aligns with the identified scam type of a crypto casino fraud and matches the Gambler Scam phishing kit used in similar campaigns.

Reputation metrics are strongly negative: Gridinsoft assigns a trust score of 1 out of 100, and the domain is listed on a security blocklist maintained by PhishDestroy, as well as appearing on one additional unnamed blocklist. VirusTotal analysis shows that 8 of 95 antivirus and URL scanning engines flagged the domain, reinforcing the malicious assessment. The domain is presently taken offline, which may be the result of takedown actions or temporary hosting removal. Defenders should update inbound and outbound filtering policies to block any HTTP requests to keonax.com and its resolved IP address, enforce DNS sinkholing for the domain, and monitor for any resurgence of the domain or associated IP range.

Continuous visibility on Cloudflare‑hosted assets is advisable, as the infrastructure can be rapidly re‑provisioned. Indicator sets, including the domain name, IP address, registrar, and nameserver configuration, should be shared with threat‑intel platforms to aid broader community detection. The lack of an SSL certificate and the low trust score further justify immediate containment and alerting of users who may have interacted with the site before it was taken offline.