raiwax[.]com

Analysis of raiwax.com, observed as offline as of July 25, 2026, indicates a high‑confidence cryptocurrency‑related brand impersonation campaign targeting the Sei ecosystem. The domain was registered on 2 January 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv6 address 2606:4700:3031::6815:2fd4, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title “Raiwax: Elon Musk’s Official Crypto Casino Powered by Blockchain”, suggesting a lure built around high‑profile names and a crypto casino narrative. The SSL certificate presented is identified as WE1, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already taken the site offline. Independent analysis on VirusTotal shows that 11 of 93 scanned security vendors flagged the domain, reinforcing the malicious classification.

A Gridinsoft trust score of 1 out of 100 further underscores the low reputation. The campaign is linked to the “Gambler Scam” phishing kit, a known template used to harvest credentials or funds from crypto‑focused victims. The impersonated brand is explicitly listed as “sei”, confirming that the attacker is attempting to deceive users of the Sei blockchain platform. Uncertainty remains around the current activity of the underlying infrastructure because the domain is reported as offline and no live HTTP response was captured.

No additional evidence of credential‑stealing forms or malware delivery has been observed, and the exact content of the site beyond the title is not publicly available. Defenders should update their domain blocklists to include raiwax.com, enforce DNS filtering for Cloudflare‑hosted IPv6 ranges associated with this indicator, and monitor for similar “Gambler Scam” kit deployments that reference Sei‑related terminology.