wexabet[.]com

Analysis of the domain wexabet.com, created on July 17, 2025 and currently taken offline, shows a deliberately crafted infrastructure aimed at brand impersonation of the foundation brand. The public page title "WEXABET | Play at the best online casino based on Blockchain" indicates a gambling‑oriented front‑end that aligns with the Gambler Scam kit identified in the payload. The domain resolves to IP address 69.5.189.54, which is registered to an AS42624 block owned by Global-Data System IT Corporation in Switzerland. The hosting provider is not associated with any known reputable CDN, and the lack of an SSL certificate further reduces the perceived legitimacy of the site.

Registration details list MAT BAO CORPORATION as the registrar, and the domain is served by four nameservers (ns1‑ns4.nameserverhub.com), a pattern commonly observed in fast‑flux or disposable hosting setups. Security assessments show the domain appears on one blocklist and has been blocked by PhishDestroy, confirming that at least one protective service identified it as malicious. VirusTotal scans report four of ninety‑five security vendors flagging the domain, reinforcing the suspicion of malicious activity. Gridinsoft assigns a trust score of 1 out of 100, indicating an extremely low reputation.

The identified scam type is a crypto scam, which, combined with the gambling‑oriented page title, suggests an attempt to lure victims into cryptocurrency transactions or deposits under the guise of a blockchain casino. While the site is presently offline, defenders should continue to monitor the associated IP range (69.5.189.54) and the four nameservers for re‑use, block the domain and related IPs in corporate firewalls, and update URL filtering lists to include wexabet.com. Additional investigation into any residual DNS records or potential command‑and‑control traffic originating from the same AS may reveal further malicious infrastructure.