ecomex[.]com[.]br

The domain ecomex.com.br was identified as a brand impersonation threat specifically targeting the MEXC cryptocurrency exchange. Currently, the domain is offline, and its risk level remains under investigation by security researchers. This site attempted to deceive users by mimicking the MEXC brand, potentially to steal login credentials or sensitive financial information.

Technical indicators reveal that ecomex.com.br was flagged on one security blocklist and was found in one AlienVault OTX threat intelligence pulse. The domain was created on April 22, 2026, and resolves to IP address 82.25.75.22. Its SSL certificate was issued by Let's Encrypt with serial E8. Notably, VirusTotal reported 0 detections out of 95 vendors at the time of analysis, meaning the domain was not yet widely identified as malicious. The page title displayed was "Gestão de Comércio Exterior com IA e Automação | eComex," which appears unrelated to MEXC but may have been used as a decoy.

Given that ecomex.com.br is currently offline, the immediate risk is reduced, but users should remain vigilant. PhishDestroy recommends that anyone who may have interacted with this domain change their MEXC account passwords immediately and enable two-factor authentication. It is also prudent to monitor financial accounts for any unauthorized activity. Security teams should add this domain to blocklists and educate users about brand impersonation tactics, especially those targeting cryptocurrency platforms.