uasmexc[.]shop

The domain uasmexc.shop has been identified as an active threat engaged in brand impersonation targeting the cryptocurrency exchange MEXC. There is no direct evidence of a drainer kit, but the impersonation of a well-known brand suggests a high risk of credential theft or fraud.

Technical analysis shows uasmexc.shop currently has a VirusTotal detection score of 15 out of 95, indicating it has not yet been flagged by most antivirus engines. The domain resolves to IP address 137.220.131.177 and uses a Let's Encrypt SSL certificate. It is listed on one security blocklist and flagged by Google Safe Browsing as SOCIAL_ENGINEERING. The domain is blocked by InversionDNS. No registrar or creation date details were provided. The page title detected is simply "MEXC," reinforcing the impersonation.

This domain remains active and continues to pose a high risk to users who may be deceived by its MEXC branding. Immediate caution is advised; users should not provide any credentials or personal information. Security teams should monitor this domain for takedown requests and update blocklists accordingly. Given its presence on at least one blocklist and Google’s social engineering flag, the threat is credible and ongoing.