mscex[.]co

Analysis of mscex.co indicates a high‑risk brand‑impersonation campaign targeting the Ethereum brand. The domain was registered on March 14 2026 through GoDaddy.com, LLC and remains active. The registrar information, combined with the recent creation date, aligns with typical rapid‑deployment tactics used by fraud operators.

The hosting infrastructure resides on Amazon’s AS14618 network in the United States, resolving to IP 34.230.114.226. The site presents a valid TLS certificate issued by Let’s Encrypt (R12) and enforces HTTP Strict Transport Security. Web‑server headers reveal Nginx serving content built with Vue.js and supporting HTTP/3, suggesting a modern, performance‑focused deployment.

Observable threat indicators include the page title, which explicitly mentions Ethereum alongside other cryptocurrency assets, confirming intent to mislead users searching for legitimate Ethereum services. The domain appears on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. Reputation scoring is extremely poor, with a Gridinsoft trust score of 1 / 100, and three of ninety‑five VirusTotal scanners have flagged the host as malicious. These data points collectively demonstrate a concerted impersonation effort.

Defenders should add mscex.co to deny‑list configurations across web gateways, email filters, and endpoint protection platforms. Continuous monitoring of the associated IP range (34.230.114.0/24) is advised, as the attacker may shift to adjacent addresses within the same Amazon‑owned block. Incident response teams should treat any traffic or credential submission to this domain as compromised and instruct users to avoid interacting with the site.