yobsmexc[.]shop

This domain, yobsmexc.shop, poses a high-risk threat as a brand impersonation phishing site targeting users of the MEXC cryptocurrency exchange platform. The site mimics the legitimate MEXC interface, presenting a fraudulent login or transaction page designed to harvest credentials, private keys, or other sensitive information. Users who interact with this site risk unauthorized access to their accounts, financial theft, or exposure to crypto-draining malware. The page title explicitly displays 'MEXC,' and the site employs common web technologies to appear legitimate while concealing its malicious intent. Analysis indicates this domain was registered on April 21, 2026, through GNAME.COM PTE. LTD., a registrar frequently associated with abusive registrations. The domain resolves to the IP address 137.220.131.177 and is flagged by 18 out of 95 security vendors on VirusTotal, with detections categorized under 'SOCIAL_ENGINEERING' by Google Safe Browsing. Additional technical indicators include the use of Vue.js, Nginx, HSTS, and HTTP/3, which are often leveraged to enhance the site's perceived authenticity. The domain appears on four security blocklists and has been taken offline, though similar infrastructure may reappear under different names. If you visited yobsmexc.shop or entered any credentials, take immediate action to mitigate potential damage. Disconnect any active sessions from the site and revoke access to any connected wallets or accounts. Change passwords for all associated accounts, particularly those linked to cryptocurrency platforms, and enable multi-factor authentication where available. Monitor accounts for unauthorized transactions and consider using a hardware wallet or cold storage for sensitive assets. Report the incident to the legitimate platform and relevant cybersecurity authorities to assist in tracking and dismantling phishing infrastructure. Users should remain vigilant for similar domains, as threat actors often reuse tactics and infrastructure across campaigns.