henomex[.]com

On 23 July 2026, henomex.com was identified as a malicious infrastructure designed to impersonate the cryptocurrency exchange MEXC. The domain was registered on 2 December 2025 through MAT BAO CORPORATION and delegated to the Cloudflare nameservers chris.ns.cloudflare.com and tricia.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site operated without an SSL certificate, indicating unencrypted HTTP traffic at the time of observation.

The page title returned by the server was "Henomex: Most Popular Online Crypto Casino Based on Blockchain," aligning with the Gambler Scam phishing kit attributed to the operation. Threat intelligence sources recorded the domain on a single security blocklist and a Gridinsoft trust score of 0 out of 100, reflecting extreme risk. VirusTotal analysis recorded 12 detections out of 93 scanning engines, confirming malicious classification across multiple vendors. The domain was also flagged by PhishDestroy, reinforcing its status as a phishing vector.

Current status is offline, preventing immediate interaction, but the historical evidence suggests a deliberate campaign targeting MEXC users with a crypto‑scam narrative. Defenders should continue to block henomex.com at DNS and proxy layers, monitor for any re‑registration attempts, and correlate any inbound traffic to the listed IP address with known Cloudflare abuse patterns. Because the site employed a known Gambler Scam kit, additional scrutiny of related domains using similar kits is recommended to pre‑empt further impersonation attempts.