niopex[.]com

This domain, niopex.com, is currently flagged as a crypto‑related phishing campaign. The site was registered on 12 October 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.147.181, an IP located in the United States and advertised as AS13335 Cloudflare, Inc. The authoritative nameservers are kenneth.ns.cloudflare.com and nelci.ns.cloudflare.com, indicating that the infrastructure is hosted behind Cloudflare’s edge network. No TLS certificate is presented, meaning the site operates without HTTPS protection. The page title returned by the live probe reads “Niopex: Most Popular Online Crypto Casino Based on Blockchain,” which aligns with the classified scam type of a crypto scam and matches the Gambler Scam phishing kit observed in the payload.

VirusTotal analysis shows that 15 of 95 security vendors have reported the domain as malicious, and the domain appears on a single external blocklist. AlienVault OTX lists the domain in one threat‑intelligence pulse, and PhishDestroy has also added it to its blocklist. The current operational status is offline, but historical evidence suggests the site was used to lure victims with promises of cryptocurrency casino rewards. Defenders should immediately block both the domain and its resolved IP address at perimeter filters, add the associated nameservers to any DNS‑based deny lists, and monitor for any future re‑registration or similar Cloudflare‑hosted assets that reference the same brand language.

Continuous monitoring of VirusTotal submissions, OTX updates, and blocklist feeds is recommended to capture any resurgence. Attribution to the Gambler Scam kit indicates that similar campaigns may reuse the same infrastructure, so security teams should also review other domains that have been associated with that kit. Until further forensic evidence becomes available, the domain should be treated as high‑confidence malicious activity.