mexcoig[.]top

This domain, mexcoig.top, is identified as a high-risk brand impersonation threat specifically targeting MEXC, a well-known cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing they are interacting with the legitimate MEXC platform, likely for the purpose of credential theft or unauthorized access to user accounts. No evidence of a crypto drainer kit was observed, but the domain’s infrastructure and content closely mirror the targeted brand’s official site, including the use of the MEXC page title and branding elements.

Infrastructure analysis reveals several critical technical indicators. The domain resolves to the IP address 202.79.165.72 and was registered through Gname.com Pte. Ltd. on February 21, 2026, a date that may suggest an attempt to appear legitimate through a seemingly long registration period. Google Safe Browsing has flagged the domain as phishing, and VirusTotal reports that 15 out of 95 security vendors have detected malicious activity associated with mexcoig.top. Additionally, the domain appears on three security blocklists, and its SSL certificate is issued by Let's Encrypt (R12), a common but not inherently malicious certificate authority often exploited in phishing campaigns.

As of the latest assessment, mexcoig.top has been taken offline, significantly reducing the immediate risk to users. However, the domain’s registration remains active, and the infrastructure could be reactivated or repurposed for future malicious campaigns. Users who may have interacted with this domain are advised to change their credentials immediately, enable multi-factor authentication on all financial and crypto-related accounts, and monitor for unauthorized transactions. Organizations should update their security blocklists to include this domain and its associated IP address to prevent future access attempts.