fosmex[.]com

fosmex.com was registered on July 17 2025 through MAT BAO CORPORATION. The domain resolves to IP 69.5.189.58, which is assigned to AS42624 Global-Data System IT Corporation and geolocated to Switzerland. No TLS certificate is present, indicating HTTP‑only service. The site’s page title reads “FOSMEX | Play at the best online casino based on Blockchain”, aligning with a crypto‑related gambling scam. VirusTotal scans show that three of ninety‑five security vendors flagged the domain, and it appears on at least one external blocklist.

Trust metrics are extremely low, with Scamadviser rating 1/100 and Gridinsoft 0/100. The domain is listed as using the “Gambler Scam” phishing kit and is categorized as a crypto scam that impersonates the cryptocurrency exchange MEXC. It has been taken offline and is currently blocked by PhishDestroy. Nameservers are ns3.nameserverhub.com and ns4.nameserverhub.com. Analysis indicates that the infrastructure—registration via a corporate registrar, Swiss‑hosted IP, lack of SSL, and low trust scores—is typical of malicious actors targeting cryptocurrency users.

The limited number of VirusTotal detections suggests that the site may have evaded broader detection, but the presence on a blocklist and the three vendor flags confirm malicious intent. Uncertainty remains regarding the exact content served before takedown, as no snapshot is available. Defenders should continue to block fosmex.com at perimeter and DNS layers, monitor the IP 69.5.189.58 for any reactivation, and add the domain to internal blacklists. Organizations that use MEXC should alert users to the impersonation attempt and advise verification of URLs before entering credentials or crypto wallets. Ongoing surveillance of the registrar and nameserver infrastructure is recommended to detect future domains that may reuse the same patterns.