jocex[.]com

This domain, jocex.com, was registered through NameCheap, Inc. on May 14, 2025 and is hosted behind Cloudflare’s network (ASN 13335) with the IP address 172.67.180.198 located in the United States. The site presents the page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Jocex”, indicating a cryptocurrency exchange façade. Technical fingerprinting shows the use of Chart.js, Ant Design, jsDelivr, Google Tag Manager, Facebook Pixel, HSTS, HTTP/3, and Cloudflare’s CDN. The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming a valid HTTPS endpoint at the time of measurement. Reputation scoring is extremely low, with a Gridinsoft trust score of 3 out of 100.

VirusTotal scans returned three positive detections out of ninety‑five vendors, confirming that security products have flagged the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a phishing or scam infrastructure. The site impersonates the decentralized finance platform 1inch, matching the “brand impersonation” threat type and the “Crypto Scam” designation. Current status is offline, indicating that the malicious hosting has been taken down or the operator has removed the site, but the underlying infrastructure—including the Cloudflare IP and the domain registration—remains observable.

Defenders should immediately add jocex.com to deny lists and block outbound traffic to the associated IP address. Monitoring of the registrar NameCheap for new domains created with similar naming patterns, as well as surveillance of Cloudflare‑hosted IP ranges linked to this certificate, is recommended. Because the page content beyond the title has not been publicly captured, further investigation may be warranted to determine whether credential‑stealing forms or additional payloads were ever served.