ratmex[.]com

This domain, ratmex.com, presents a targeted brand impersonation threat against Blast, a cryptocurrency-based gaming platform. Analysis of the page title, 'RATMEX | Enter the world of sport and stakes!', indicates an attempt to deceive users into believing the site is an official or affiliated betting service for Blast. The domain mimics legitimate crypto-gaming portals, potentially harvesting credentials, payment details, or deploying malicious payloads under the guise of sports wagering. The absence of an SSL certificate further elevates risk, as user interactions occur over unencrypted HTTP, exposing data to interception or manipulation. Infrastructure analysis reveals the domain was registered on May 7, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. It resolves to the IP address 57.129.97.29, hosted on OVH SAS (AS16276) in Germany, a provider commonly leveraged for bulletproof hosting. Despite its active status, the domain appears on only one security blocklist, and VirusTotal reports 0/95 detections, suggesting limited visibility or evasion techniques. The combination of recent registration, low detection rates, and impersonation of a niche crypto-gaming brand indicates a calculated, low-profile campaign. Users who have visited ratmex.com should immediately revoke any credentials or payment details entered on the site, as these are likely compromised. Monitor financial accounts and crypto wallets for unauthorized transactions, and consider reimaging devices if malware exposure is suspected. Report the domain to relevant security teams or abuse contacts, including the registrar (NiceNIC) and hosting provider (OVH SAS), to facilitate takedown efforts. Exercise heightened caution with unsolicited links or communications referencing Blast or sports betting, particularly those directing to newly registered domains.