zoromex[.]com

zoromex.com is a newly registered domain (created 12 December 2025) that has been observed masquerading as the cryptocurrency exchange MEXC. The site title returned from the HTTP response reads "Zoromex: Most Popular Online Crypto Casino Based on Blockchain," indicating a crypto‑casino narrative that aligns with the "Gambler Scam" phishing kit previously catalogued in threat intelligence feeds. The domain resolves to the IP address 172.67.182.148, which belongs to the Cloudflare network (ASN 13335) and is geolocated in the United States. Two Cloudflare nameservers – lakas.ns.cloudflare.com and meadow.ns.cloudflare.com – are configured for the zone, a typical pattern for fast‑flux or anonymity services. No TLS certificate is presented, meaning the site is reachable only over HTTP, which further reduces the credibility of a legitimate exchange login page.

Inspection by VirusTotal shows that 14 of 93 AV engines flagged the host, reinforcing the suspicion of malicious activity. The domain appears on a single security blocklist and is explicitly listed by PhishDestroy as a known phishing vector. Gridinsoft assigns a trust score of 1/100, the lowest possible rating, reflecting extreme distrust. The registrar listed is MAT BAO CORPORATION, a known registrar used by several abusive domains.

The domain is currently offline, suggesting the operators have taken the site down either voluntarily or after takedown action. However, the underlying infrastructure – Cloudflare IP address, lack of SSL, and use of a known gambling‑scam kit – remains available for rapid re‑deployment. Defenders should add zoromex.com to URL and DNS block lists, monitor the associated IP range (172.67.182.0/24) for future activity, and enforce strict HTTPS‑only policies to prevent accidental connections to non‑TLS sites. Continuous review of threat intel feeds for the "Gambler Scam" kit and for any resurgence of MEXC‑related impersonation campaigns is recommended.