tepomex[.]com

Analysis of tepomex.com shows a high‑risk brand‑impersonation campaign targeting the MEXC exchange. The site presents a page title of "Home | Tepomex" and is protected by a Let’s Encrypt certificate (E7). DNS resolution points to 172.67.182.85, an address owned by Cloudflare, Inc. in Canada, and the domain leverages Cloudflare services including Browser Insights and HTTP/3. Infrastructure signals include a Gridinsoft trust score of 1/100 and presence in four AlienVault OTX pulses. The domain was registered on June 9, 2026 through Fewmoretaps OU d/b/a Trustname.com and is currently listed on one security blocklist, with PhishDestroy already blocking it. VirusTotal scans report five of ninety‑one security vendors flagging the domain. HTTP responses return a 403 status, indicating restricted access to the underlying content. While the visible page title suggests a generic landing page, no further content analysis is available, leaving the exact phishing payload unverified. Defenders should immediately block tepomex.com at perimeter and endpoint layers, add it to internal threat‑intel feeds, and monitor for any related C2 activity or credential‑harvesting attempts associated with the MEXC brand. Continuous observation of Cloudflare‑originated IP ranges and correlation with the reported threat pulses is advised to capture potential re‑hosting attempts.