tomegex[.]com

This domain, tomegex.com, is flagged as a credential theft operation targeting cryptocurrency users. Analysis indicates the site impersonates a legitimate crypto exchange platform, employing fake login portals to harvest wallet credentials and private keys. No specific drainer kit signatures were identified, but the infrastructure aligns with known crypto-phishing campaigns observed in early 2026. The domain exhibits no direct brand association with major exchanges, suggesting a generic but high-risk impersonation tactic. Infrastructure analysis reveals tomegex.com was registered on February 21, 2026, with a creation date that predates typical legitimate domains, a common red flag for phishing operations. The domain resolves to the IPv6 address 2606:4700:3036::6815:12db, hosted on Cloudflare’s network (AS13335), which is frequently leveraged to obscure malicious infrastructure. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is classified as WE1, indicating a low-validation certificate often used by threat actors to mimic legitimacy. Google Safe Browsing status is not explicitly provided, but the domain’s offline status suggests prior detection and mitigation. Current status indicates tomegex.com has been taken offline, likely due to detection by security systems or manual takedown efforts. Despite its offline state, the domain’s infrastructure remains a residual risk, as threat actors may repurpose the same IP or registrar for future campaigns. Users who interacted with the domain prior to takedown should assume credential compromise and take immediate action, including revoking wallet access, rotating passwords, and monitoring for unauthorized transactions. Organizations are advised to block the domain, its resolved IP, and associated SSL certificate fingerprints in network security controls to prevent future exposure.