fotnex[.]com

This domain, fotnex.com, poses a targeted brand_impersonation threat against users of cryptocurrency-based gambling platforms. Analysis indicates the site masquerades as a legitimate blockchain casino, using the page title 'Fotnex: Most Popular Online Crypto Casino Based on Blockchain' to deceive visitors into depositing digital assets. The infrastructure is designed to exploit trust in crypto gambling services, potentially leading to financial theft or credential harvesting through fake login portals or wallet connection prompts. Evidence confirms the domain was registered on August 23, 2025, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate malicious origins. Security telemetry shows 9 out of 95 vendors on VirusTotal flag the domain as malicious, while it appears on one additional security blocklist. Notably, the domain lacks an SSL certificate, further indicating its fraudulent nature and increasing the risk of man-in-the-middle attacks during user interactions. Users who visited fotnex.com should immediately revoke any wallet permissions granted to the site and monitor connected accounts for unauthorized transactions. If credentials or private keys were entered, affected parties must transfer remaining assets to a new, secure wallet and assume all previously used keys are compromised. Browser data, including cookies and cached files, should be cleared to eliminate residual tracking mechanisms. Organizations should update internal blocklists to include this domain and its associated IP address (188.114.96.3) to prevent future access attempts. Given the elevated risk level and offline status, continued vigilance is advised, as threat actors may reactivate the domain or migrate to similar infrastructure.