mepoyi[.]cc

PhishDestroy identifies mepoyi.cc as an active crypto drainer domain recently deployed to siphon cryptocurrency assets from unwary users. This site is engineered to mimic popular crypto interfaces and prompt wallet connections under the guise of airdrops or sign-up bonuses, after which malicious JavaScript drains token balances without explicit approval. The domain was registered through Gname.com Pte. Ltd. on September 01, 2025, and resolves to IP 154.82.90.103 under a freshly issued Let’s Encrypt SSL certificate, indicating low operational maturity but immediate risk to crypto users.

This domain exhibits multiple red-flag indicators for crypto drainer activity. VirusTotal currently returns 0 detections out of 95 scanners, demonstrating that signature-based defenses have not yet flagged it despite its malicious intent. The registrar Gname.com Pte. Ltd. has been repeatedly implicated in bulk domain abuse, and the domain’s first-registration date (September 01, 2025) suggests a very recent campaign. Furthermore, the site leverages a legitimate SSL certificate to appear trustworthy while hosting wallet-draining scripts. These factors collectively signal an elevated risk level that is actively evolving.

If you or your organization visited mepoyi.cc, immediately disconnect any connected wallets, revoke any unauthorized token approvals via tools like revoke.cash, and transfer remaining assets to a clean wallet. Report the incident to your wallet provider and consider filing a complaint with local cybercrime units. Block the domain at DNS and network levels to prevent further access. Exercise heightened scrutiny for unsolicited crypto airdrop links and always verify URLs against official sources before interacting with wallet interfaces.