wetmox[.]com

wetmox.com has been identified as an active brand impersonation threat, specifically targeting users of crypto casino and gambling services. The site mimics legitimate decentralized Web3 gambling brands, as evidenced by its page title, and uses similar branding elements to attract potential victims. No specific crypto drainer kit was observed in the initial analysis, but the platform’s mimicry tactics are consistent with credential harvesting or financial theft campaigns in this vertical.

Technical analysis reveals that wetmox.com was registered through Fewmoretaps OU d/b/a Trustname.com on June 8, 2026. The domain currently resolves to IP address 188.114.96.3 and is protected by a Google Trust Services SSL certificate. According to VirusTotal, 1 out of 95 security vendors currently flags this domain as malicious. The page leverages advertising and analytics technologies including Twitter Ads, Facebook Pixel, Cloudflare Browser Insights, and Cloudflare infrastructure. As of this report, there is no evidence that the domain is blocked by major browser blocklists.

The domain remains active, continuing its impersonation campaign against crypto gambling brands. Given the use of web3-associated language and trust signals, users are at high risk of credential and asset compromise. Immediate action is recommended: block wetmox.com at endpoint and network levels, monitor for related indicators, and warn potential victims. The site’s ongoing availability increases the risk of successful user compromise until takedown or further mitigation is achieved.