wexloon[.]com

Analysis of wexloon.com shows a confirmed malicious infrastructure that was taken offline prior to the assessment date of July 25, 2026. The domain was registered on September 09, 2025 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare, Inc. (AS13335) in the United States. The authoritative nameservers are heidi.ns.cloudflare.com and owen.ns.cloudflare.com. No TLS certificate was presented, indicating the site operated without HTTPS protection.

The page title retrieved from the site—"Wexloon: Most Popular Online Crypto Casino Based on Blockchain"—matches a known crypto‑focused gambling scam, and the intelligence catalogues the activity as a Crypto Scam employing a Gambler Scam phishing kit. Reputation checks show a Gridinsoft trust score of 0 out of 100 and placement on a single security blocklist. The domain is listed in one AlienVault OTX pulse and was flagged by 10 of 95 security vendors on VirusTotal. PhishDestroy has also blocked the domain.

Given the combination of a high‑risk scam classification, the lack of encryption, and multiple vendor detections, defenders should prioritize immediate blocking of wexloon.com at the DNS and proxy layers, add its resolving IP 188.114.97.3 to network‑level deny lists, and ingest the associated OTX pulse and blocklist entries into existing threat‑intel platforms. Continuous monitoring of Cloudflare‑hosted IP ranges for any resurgence of the same infrastructure is advisable, and any inbound traffic attempting to contact the domain should be logged and investigated for potential compromised credentials or lure attempts. The absence of additional content analysis beyond the page title limits further attribution, but the present evidence is sufficient to treat the domain as an active crypto gambling phishing vector.