faramex[.]com

PhishDestroy identifies faramex.com as an active brand impersonation site masquerading as the legitimate MEXC cryptocurrency exchange. This domain leverages visual mimicry and urgency-driven messaging to trick visitors into connecting crypto wallets or entering credentials, with malicious payloads engineered to drain funds through deceptive wallet connection approvals. Registrant behavior, SSL details, and hosting infrastructure correlate with known crypto-drainer campaigns that harvest private keys and seed phrases, indicating a high probability of direct financial theft upon interaction. Threat actors registered the domain through Global Domain Group LLC and provisioned a Let’s Encrypt SSL certificate to enhance credibility, while resolving to IP 188.114.97.3—a known gateway for malicious scripts in prior incidents. The domain was created on March 16, 2026, only days before detection, minimizing historical data and evading early blocklists.

This domain remains undetected on VirusTotal with 8/95 engines flagging it as malicious as of the latest scan, suggesting a fresh deployment avoiding signature coverage. It currently appears on zero public blocklists, enabling continued exposure to potential victims. The choice of registrar, infrastructure, and certificate authority aligns with tactics used by bulletproof hosting providers that delay takedowns and maintain uptime for fraudulent operations. Given the absence of detections and blocklist coverage, the risk of encountering this domain in phishing campaigns or via malvertising remains elevated until proactive blocking is implemented.

If you visited faramex.com or connected any wallet, immediately revoke all unauthorized permissions using your wallet’s “connected apps” or “revoke permissions” feature. Do not interact with any prompts or sign transactions unless you have independently verified the correct MEXC domain via official channels. Report your wallet address and any suspicious transactions to MEXC support and your local cybercrime unit. Use PhishDestroy’s real-time scanner to confirm whether the site is malicious and to receive updated takedown status. Remain vigilant: treat unsolicited links claiming to offer MEXC promotions as high-risk until independently validated.