mexcen-cdn[.]pages[.]dev

PhishDestroy identifies mexcen-cdn.pages.dev as an active brand impersonation domain masquerading as MEXC, a major cryptocurrency exchange platform. This domain has been classified under seed bd0477 with a current risk status of under_investigation but demonstrates clear malicious intent through impersonation tactics. The infrastructure leverages Cloudflare Pages to host content that closely resembles legitimate MEXC branding, potentially targeting users seeking crypto trading services. This domain was flagged by zero out of 95 VirusTotal vendors as of the latest scan, indicating it remains undetected by most antivirus engines despite its deceptive nature. The domain resolves to IP address 172.66.44.253, which is hosted under Cloudflare, Inc.’s infrastructure. The SSL certificate is issued by Google Trust Services, adding an additional layer of apparent legitimacy. Registration through Cloudflare Pages suggests a deliberate attempt to exploit trusted hosting services for malicious purposes. Historical data indicates the domain was created recently, with no prior reputation or trust scores established at this time. Given the active status of this domain and its specific targeting of MEXC users, immediate action is recommended. Organizations and individuals should block mexcen-cdn.pages.dev at the network and DNS levels to prevent access. Additionally, users should be alerted to verify the authenticity of MEXC-related domains before engaging with any services, particularly those involving cryptocurrency transactions. Continuous monitoring of this domain and related infrastructure is advised due to the evolving nature of such threats. Security teams should also consider updating firewall rules and threat intelligence feeds to include this domain as a confirmed malicious entity.