xemowex[.]com

Analysis of xemowex.com, created on 24 October 2025 and registered through Dominet (HK) Limited, shows the domain is currently offline but retains a set of technical indicators consistent with a crypto‑focused phishing campaign. The site resolved to the IP address 172.67.139.161, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution used the Cloudflare nameservers alaric.ns.cloudflare.com and yolanda.ns.cloudflare.com. No SSL certificate was observed during the brief scan, indicating the site was served over plain HTTP at the time of capture.

The page title returned by the server was "Xemowex: Most Popular Online Crypto Casino Based on Blockchain," matching the reported scam type of a crypto casino phishing operation. The underlying phishing kit has been identified as the Gambler Scam kit, a known template used to harvest cryptocurrency credentials. Reputation data shows a Gridinsoft trust score of 1 out of 100 and a single entry on a security blocklist. VirusTotal flagged the domain in 11 of 95 scanned engines, and PhishDestroy lists it as blocked.

These indicators collectively suggest a low‑reputation, high‑risk infrastructure used to lure victims into a fraudulent crypto‑casino experience. Uncertainty remains regarding the current activity level, as the domain is reported offline and no further HTTP response codes have been captured. Defenders should continue to block any traffic to 172.67.139.161, enforce DNS sinkholing for the domain, and monitor for similar Gambler‑kit deployments that reference crypto‑casino branding. Regular updates from threat‑intel feeds should be consulted to capture any re‑activation of the domain or related infrastructure.