narewex[.]com

Analysis of the domain narewex.com, created on 02 Oct 2025 and registered via Atak Domain, shows a deliberate crypto‑focused phishing campaign. The site’s sole visible artifact is the page title “Narewex: Most Popular Online Crypto Casino Based on Blockchain”, which aligns with the classified scam type “Crypto Scam” and the identified Gambler Scam phishing kit. The domain resolves to the IP address 188.114.96.3, which is announced as belonging to AS13335 Cloudflare, Inc. and geolocated to the United States. The hosting uses Cloudflare’s nameservers hera.ns.cloudflare.com and oswald.ns.cloudflare.com, a typical pattern for fast‑flux or hide‑behind services. No TLS certificate is presented, indicating the site operates over plain HTTP, a common trait of low‑effort phishing pages.

Multiple security controls have already taken action. PhishDestroy has blocked the domain, and it appears on one external blocklist. VirusTotal reports that 16 out of 95 scanned scanners flagged the domain, demonstrating a moderate detection consensus among AV engines. AlienVault OTX cites the domain in a single threat‑intel pulse, confirming its presence in broader community feeds. Gridinsoft assigns a trust score of 1 / 100, reflecting extreme untrustworthiness.

The current HTTP status is “taken offline”, suggesting the site is no longer reachable, yet the indicators remain useful for remediation. Defenders should continue to enforce blocklisting of the domain and its associated IP address at perimeter and endpoint security layers. Because the domain uses Cloudflare infrastructure, additional monitoring of other sub‑domains that may resolve to the same IP range is advised. Updating URL filtering and reputation feeds with the observed indicators—page title, registrar, nameservers, and detection counts—will help prevent future replicas. Incident response teams should also flag any inbound traffic to 188.114.96.