nesomex[.]com

Analysis of nesomex.com, created on September 24, 2025 and currently taken offline, shows a classic crypto‑scam infrastructure that masquerades as the brand x.com. The site’s page title, "Nesomex: Most Popular Online Crypto Casino Based on Blockchain," confirms the use of a gambling theme to lure victims. DNS resolution points to IP 172.67.141.158, an address owned by Cloudflare (AS13335) located in the United States, and the domain uses Cloudflare’s pam.ns.cloudflare.com and randy.ns.cloudflare.com nameservers. No SSL certificate was observed, indicating that the site was served over plain HTTP before being shut down.

Security telemetry records three of ninety‑five VirusTotal scanners flagging the domain, and the domain appears on a single external blocklist. The Gridinsoft trust score of 0 / 100 further underscores its malicious reputation. Registration was performed through Web Commerce Communications Limited, a registrar often associated with disposable or low‑cost registrations. The phishing kit identified is the "Gambler Scam" package, which aligns with the casino‑oriented page title.

PhishDestroy has already blocked the domain, confirming that threat‑intel communities consider it hostile. Uncertainty remains around active payload delivery because the site is offline and no live HTTP response or SSL handshake can be examined; consequently, the exact phishing flow and any embedded malicious scripts cannot be verified at this time. Defenders should add nesomex.com to internal blocklists, monitor for any future resolution to the same Cloudflare IP range, and enforce strict outbound filtering for requests to newly registered domains that resolve to Cloudflare infrastructure. Additionally, security teams should update brand‑impersonation detection rules for x.com to include the observed page title and the Gambler Scam kit fingerprint, and consider sharing the domain’s indicators of compromise with broader threat‑sharing platforms to aid collective defense.