What Gridinsoft observed on Fomoearn.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260902155009-40a6e38e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Android Automation App Distribution
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The exact downloadable app, not merely a domain reputation label, supports a Suspicious verdict. It uses broad Accessibility control to observe and act on another app's interface, displays an overlay, requests additional special system privileges, and can install outside-store updates. The reviewed evidence does not establish credential theft or a specific malware payload, so a Malicious verdict would overstate the findings.
Analyst findings
Review 5 documented observations View evidence
The reviewed public pages served the advertised watch-to-earn service over HTTPS. The Android page disclosed that the app advances video queues automatically and linked a same-site APK download; the reviewed public-page requests did not trigger an unrelated redirect or an automatic download.
-
HTTP status
200 -
Final URL
https://fomoearn.com/android - Page element The page identifies version 3.1.5 (Build 28), automated video progression, Accessibility, overlay, and a same-site APK download.
- Analyst observation The APK download required an explicit request; no unrelated redirect or unsolicited file delivery was observed in the reviewed public flow.
The official download route returned a 53,925,973-byte Android package identified as FomoEarn 3.1.5 (version code 28), package com.fomoearn.mobile. The package used an APK Signature Scheme v2 certificate whose subject and issuer both identified FomoEarn.
-
HTTP status
200 -
Final URL
https://fomoearn.com/download/FomoEarn-v3.1.5-vc28.apk - MIME type application/vnd.android.package-archive
- File SHA-256 10024bcc709cc0a3b5d2b233d4dc4c302034b781bd962652517b1a3d908bdad2
- Certificate fact APK Signature Scheme v2; certificate subject and issuer: CN=FomoEarn, O=FomoEarn, C=US.
The APK declares an Accessibility service for all event types that can retrieve window content, request touch-exploration mode, and perform gestures. It also requests overlay, package-install, system-settings, location, battery-optimization bypass, wake-lock, network, advertising-identifier, and biometric-related permissions.
- Analyst observation AutomationAccessibilityService is protected by BIND_ACCESSIBILITY_SERVICE and declares all event types, canRetrieveWindowContent=true, canRequestTouchExplorationMode=true, and canPerformGestures=true.
- Analyst observation Declared special permissions include SYSTEM_ALERT_WINDOW, REQUEST_INSTALL_PACKAGES, WRITE_SETTINGS, REQUEST_IGNORE_BATTERY_OPTIMIZATIONS, ACCESS_FINE_LOCATION, and ACCESS_COARSE_LOCATION.
Static code review tied the broad privileges to the advertised automation: the package identifies YouTube UI elements, instructs the user to enable Accessibility so the app can watch video for the user, displays a countdown over YouTube, performs completion actions, and contains an outside-store APK update and installation flow.
- Analyst observation The package references com.google.android.youtube and YouTube player, current-time, skip-ad, and error-view resource identifiers.
- Analyst observation Compiled application text states that Accessibility lets the app watch the video for the user and that the overlay displays the countdown over YouTube.
- Analyst observation Compiled application code contains update checks, APK download-and-install functions, and the local update filename fomoearn-update.apk.
The root host resolved through Cloudflare and presented a valid certificate for fomoearn.com and its wildcard namespace. The www host did not resolve during the review. Public archive indexing showed the first bounded successful captures on 21 August 2026, consistent with the recent 9 August 2026 registration date.
- DNS fact A: 104.21.28.253 and 172.67.147.240; AAAA: 2606:4700:3030::6815:1cfd and 2606:4700:3035::ac43:93f.
- Certificate fact Google Trust Services WE1 certificate for fomoearn.com and *.fomoearn.com, valid 2026-08-22 through 2026-11-20.
- Analyst observation The bounded archive index returned 84 successful root-domain objects from 2026-08-21 and no earlier successful record in that query.
Scope and limitations
- The APK was reviewed statically and was not installed or executed on a test device; runtime network traffic, post-login tasks, and later update packages were not observed.
- No account was created, no credentials or payment destination were submitted, and the site's payout claims were not independently verified.
- The result applies to the exact APK hash and public pages reviewed at the recorded time; a later APK or update requires a separate object-level review.
Help protect others by sharing this page on social media! The more people who know about fomoearn.com, the fewer chances they have to deceive someone else. Help others evaluate fomoearn.com by sharing this page on social media!