tonewex[.]com

The domain tonewex.com has been identified as a brand impersonation threat targeting users of a decentralized Web3 gambling platform. Analysis confirms the domain was designed to mimic a legitimate crypto casino, presenting itself under the title "Tonewex | Decentralized Web3 Gambling Site with Provable Trust." The domain is currently offline, though its infrastructure remains a documented risk for potential re-emergence or reuse in similar campaigns. Technical indicators reveal the domain was registered on June 9, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolved to the IP address 172.67.222.25 and utilized an SSL certificate issued by Google Trust Services, a common tactic to lend superficial legitimacy. Detection metrics show the domain was flagged by 4 of 95 security vendors on VirusTotal and appears on one security blocklist. The infrastructure analysis further indicates the domain was blocked by at least one anti-phishing engine, reinforcing its classification as a confirmed malicious entity. Given the elevated risk level associated with brand impersonation in the cryptocurrency and gambling sectors, organizations and end-users are advised to treat this domain as compromised. Network administrators should ensure the domain remains blocked at the DNS and proxy levels to prevent accidental access. Users who may have interacted with the site should verify wallet addresses, transaction histories, and device integrity for signs of compromise. Monitoring for newly registered domains with similar naming patterns or infrastructure is recommended to preempt further abuse.