io-famex-exchange[.]pages[.]dev

The domain io-famex-exchange.pages.dev is currently identified as a high-risk brand impersonation threat targeting the Ethereum cryptocurrency. This domain mimics legitimate services to deceive users into engaging with fraudulent content, potentially exposing them to a crypto drainer attack. The page title 'Beginner’s Guide to FameEX Exchange: Trade Bitcoin, Ethereum' indicates an attempt to lure cryptocurrency enthusiasts by impersonating well-known platforms to harvest sensitive information.

Technical analysis reveals that the domain was created on November 04, 2025, and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.96.3, located in Canada (CloudFlare, Inc.). The domain is currently flagged by 1 out of 95 security vendors on VirusTotal as suspicious. Additionally, it has been blocked by major security organizations, appearing on three security blocklists: PhishDestroy, MetaMask, and SEAL. These indicators suggest significant malicious intent and operational sophistication.

The domain remains active and poses an ongoing risk to unsuspecting users. Security teams are advised to monitor and block this domain at their network perimeter and update threat intelligence feeds accordingly to mitigate potential impacts. Users should be educated to recognize such impersonation attempts and encouraged to report suspicious activities to their respective security teams promptly.