# PhishDestroy domain threat record: mexc-partner.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mexc-partner.com/
Machine-readable companion: https://phishdestroy.io/domain/mexc-partner.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-19 07:04:05 UTC
- Last availability or vendor check: 2026-10-22 10:29:59 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 141.164.54.198
- Registrar in stored WHOIS data: Megazone Corp., dba HOSTING.KR
- Registrar country in stored WHOIS data: KR
- Last stored HTTP status: 200
- Registration date (registry RDAP, mexc-partner.com): 2024-07-25 06:37:20 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0b8be-eb8f-7391-a82d-518db20513b9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mexc-partner.com
- Certificate Transparency search: https://crt.sh/?q=%25.mexc-partner.com
- Web Archive lookup: https://web.archive.org/web/*/https://mexc-partner.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
mexc-partner.com poses as the cryptocurrency exchange MEXC. Its page title, "mexc 거래소 | MEXC Exchange" (거래소 is Korean for "exchange"), shows it is aimed at Korean-speaking traders. The "partner" wording borrows the look of an official affiliate or partnership portal. PhishDestroy first flagged it on 2026-09-19, and the page was still up and serving content on 2026-10-19.

How the scam works
Sites that impersonate an exchange copy the real brand's look so visitors believe they are on MEXC or an authorised partner. From there, the victim is typically asked to log in, which hands account credentials and one-time codes to the operators. Alternatively, the victim is told to deposit crypto into a "partner" account that the attackers control. Funds sent there cannot be recovered, and stolen logins can be used to empty the victim's real MEXC account.

Evidence
Six of 91 VirusTotal engines flagged the domain as of 2026-09-29: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That count is modest, so many security tools will still let the page load without warning. Stronger backing comes from the blocklists. MetaMask and SEAL list the domain alongside PhishDestroy, which means wallet users get protection from tools that rely on those lists. Two AlienVault OTX threat pulses also reference the domain.

Infrastructure
The domain was registered on 2024-07-25 through Megazone Corp., dba HOSTING.KR, more than two years before PhishDestroy detected it. That gap suggests a name held in reserve or reused rather than one created just for this campaign. It resolves to 141.164.54.198 on The Constant Company, LLC network, located in South Korea. A Korean registrar, Korean hosting and a Korean page title together fit an operation focused on the Korean market.

What to do
Do not log in or deposit anything on this site. If you entered your MEXC credentials, change your password right away from the official app and reset two-factor authentication. Then review active sessions, API keys and withdrawal whitelist addresses for anything you did not add. If you sent crypto to an address shown on the page, report the transaction to MEXC support and the police, and keep your transaction hashes. Ignore anyone who later offers to recover the funds for a fee. Defenders should block the domain and its IP and alert Korean-speaking users about fake MEXC "partner" pages.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0b8be-eb8f-7391-a82d-518db20513b9/
VirusTotal report: https://www.virustotal.com/gui/domain/mexc-partner.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mexc-partner.com
Archived copy: https://web.archive.org/web/20260922132034/https://mexc-partner.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:39:32 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/rR9CmPXC/c826d6a8ce6a.png
  Captured: 2026-09-19 08:19:39 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0b8be-eb8f-7391-a82d-518db20513b9.png
  Captured: 2026-09-19 08:19:39 UTC
  Source report: https://urlscan.io/result/01a0b8be-eb8f-7391-a82d-518db20513b9/
- URLScan capture 2: https://urlscan.io/screenshots/01a0a8b0-4511-7440-b3c6-1da4a9eebc1c.png
  Captured: 2026-09-19 07:04:05 UTC
  Source report: https://urlscan.io/result/01a0b8be-eb8f-7391-a82d-518db20513b9/
- URLQuery: https://screenshots.phishdestroy.io/uq/d391efb1-ddaa-4973-b4de-11dcb79fae9e.png
  Captured: 2026-09-19 08:28:35 UTC
  Source report: https://urlquery.net/report/d391efb1-ddaa-4973-b4de-11dcb79fae9e
  SHA-256: bfa5066ade6eceebd6545dda92ae04b2740172c88d75f4d6eff8700637feff8c
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/69036e81-a3f3-41e0-989e-42d5f4134b16.png
  Captured: 2026-09-19 07:05:54 UTC
  Source report: https://radar.cloudflare.com/scan/69036e81-a3f3-41e0-989e-42d5f4134b16
  SHA-256: 55bd98df4d4d56da6e009ea579fa058f16202194f3e5d98986317e900d666273
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a03ae3-ecc3-7337-9d87-5127580e559b.png
  Captured: 2026-08-25 21:47:00 UTC
  Source report: https://urlscan.io/result/01a03ae3-ecc3-7337-9d87-5127580e559b/
  SHA-256: dac5e8a66d20e12fd2e3ecb5e3eac3aeb6b480fbb39a667eecccd4878c832871
- URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a0755d-ed07-73c7-b853-7fa1544c7df3.png
  Captured: 2026-09-06 06:18:18 UTC
  Source report: https://urlscan.io/result/01a0755d-ed07-73c7-b853-7fa1544c7df3/
  SHA-256: dac5e8a66d20e12fd2e3ecb5e3eac3aeb6b480fbb39a667eecccd4878c832871
- URLScan · 2026-09-10: https://screenshots.phishdestroy.io/us/01a08a18-7af1-77ce-8db4-8cccd9bbb2c6.png
  Captured: 2026-09-10 06:54:25 UTC
  Source report: https://urlscan.io/result/01a08a18-7af1-77ce-8db4-8cccd9bbb2c6/
  SHA-256: dac5e8a66d20e12fd2e3ecb5e3eac3aeb6b480fbb39a667eecccd4878c832871
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0b8ab-26b0-71eb-8497-4b07b911b0b8.png
  Captured: 2026-09-19 07:57:14 UTC
  Source report: https://urlscan.io/result/01a0b8ab-26b0-71eb-8497-4b07b911b0b8/
  SHA-256: dac5e8a66d20e12fd2e3ecb5e3eac3aeb6b480fbb39a667eecccd4878c832871
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fb95-c342-75e4-9550-22323ca72c44.png
  Captured: 2026-10-02 07:48:22 UTC
  Source report: https://urlscan.io/result/01a0fb95-c342-75e4-9550-22323ca72c44/
  SHA-256: dac5e8a66d20e12fd2e3ecb5e3eac3aeb6b480fbb39a667eecccd4878c832871
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14de1-1ac3-7778-9371-17bacc04e3e5.png
  Captured: 2026-10-18 07:19:33 UTC
  Source report: https://urlscan.io/result/01a14de1-1ac3-7778-9371-17bacc04e3e5/
  SHA-256: dac5e8a66d20e12fd2e3ecb5e3eac3aeb6b480fbb39a667eecccd4878c832871

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:26:55Z",
        "uuid": "01a0b8be-eb8f-7391-a82d-518db20513b9",
        "scanned_at": "2026-09-19T08:18:47Z",
        "final_url": "https://mexc-partner.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mexc-partner.com/",
                "from": "http://mexc-partner.com/",
                "status": 307
            }
        ],
        "ip": "141.164.54.198",
        "ptr": "141.164.54.198.vultrusercontent.com",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "wordpress-1315258-5831060.cloudwaysapps.com"
        ],
        "ips": [
            "173.194.114.94",
            "172.217.197.95",
            "141.164.54.198"
        ],
        "asns": [
            "15169",
            "20473"
        ],
        "countries": [
            "US",
            "KR"
        ],
        "link_domains": [
            "www.mexc.com"
        ],
        "doc_hash": "e1fe33ab5347bec43d56e347d2dc2f28d8deff32099fbd7b8134a1b89b0b2b9c",
        "script_hashes": [
            "56fa17293a0db4bfdeea7ec26d8d6a77b4960f3f5a83a73eea8b82460597d92d",
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "83eda8e5540512ca57e2216df1c90dd4bb2cb49f3f58188345de9582855648e0",
            "8dd3674bae946e2e04bc962443f0994d736a761bb28e816c20aee6391ef242ed",
            "c66f47147d5fe3cceeaa47a93ff7440a328f859b049deec2f9d8f414e9137474",
            "b7a27a4b4abfc300eaf7d9151afeef8df2663d98586e38f59f91bbe98ef30af7",
            "1842d6e4d3c7399fdb01ab4b0a7dd5c1d9c096110de0532181ed581f14e9e813",
            "77c0a6d635dad44b53a9eb9f0f367a1bd3bf3620c0e41d3a4c15d1313f2553f0",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "breeze_prefetch",
            "ready",
            "get_prefetch_key",
            "search_for_banned_links",
            "breeze_ignore_special_links",
            "jQuery",
            "astra",
            "astraGetParents",
            "astraToggleClass",
            "astraTriggerEvent",
            "astraSmoothScroll",
            "astScrollToTopHandler",
            "popupTriggerClick",
            "AstraToggleSubMenu",
            "AstraToggleSetup",
            "astraNavMenuToggle",
            "webpackChunkelementorFrontend",
            "elementorModules",
            "elementorFrontendConfig",
            "elementorFrontend",
            "_wpemojiSettings",
            "twemoji",
            "wp",
            "lazyloadRunObserver",
            "events"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "mexc-partner.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "mexc-partner.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-09T16:11:50Z",
            "valid_from": "2026-09-10T16:11:51Z"
        },
        "domain_age_days": 786,
        "apex_age_days": 786,
        "tls_age_days": 8,
        "tls_valid_days": 89,
        "requests": 25,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 60,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:28Z",
        "uuid": "69036e81-a3f3-41e0-989e-42d5f4134b16",
        "scanned_at": "2026-09-19T07:05:54Z",
        "final_url": "https://mexc-partner.com/",
        "status": 200,
        "history": [
            {
                "url": "https://mexc-partner.com/",
                "status": 200
            }
        ],
        "dom_hash": "f1124b7c6c510414eec022b7068a149961eff97a9b56efa263f226dfb3fe0176",
        "doc_hash": "fba72a1d1ccaf387e065b86ec349a9800aee68d0fd2027dc867948973a9cc793",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mexc-partner.com",
                "type": "A",
                "value": "141.164.54.198"
            }
        ],
        "dnssec_valid": false,
        "ip": "141.164.54.198",
        "whois": {
            "registrar": "Megazone Corp., dba HOSTING.KR",
            "created": "2024-07-25T06:37:20Z",
            "updated": "2026-01-04T03:58:16Z",
            "expires": "2027-07-25T06:37:20Z",
            "nameservers": [
                "ns1.hosting.co.kr",
                "ns2.hosting.co.kr",
                "ns3.hosting.co.kr",
                "ns4.hosting.co.kr"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:48:09Z",
        "analysis_at": "2026-10-21T08:26:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Megazone Corp., dba HOSTING.KR",
        "created": "2024-07-25T12:00:00Z",
        "expires": "2027-07-25T06:37:20Z",
        "updated": "2026-01-04T12:00:00Z",
        "first_seen": "2024-07-28T16:03:30Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "141.164.54.198"
            },
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "admin.mexc-partner.com",
                "value": "ns1.hosting.co.kr"
            },
            {
                "ttl": 180,
                "type": "NS",
                "value": "ns4.hosting.co.kr"
            },
            {
                "ttl": 180,
                "type": "NS",
                "value": "ns2.hosting.co.kr"
            },
            {
                "ttl": 180,
                "type": "NS",
                "value": "ns1.hosting.co.kr"
            },
            {
                "ttl": 180,
                "type": "NS",
                "value": "ns3.hosting.co.kr"
            }
        ],
        "dns_at": "2026-10-21T08:27:05Z",
        "jarm": "2ad2ad16d2ad2ad00042d42d000000df133019600a83abfb096ff3e86cd79d",
        "cert": {
            "san": [
                "mexc-partner.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6ab9b6e2ccc3740b96f409e16dc6d2e440c",
            "sha256": "be1e1dfea133a7e8079b1d16fd1ef3f59fdfcbf8d57eb8c4ead5ba3a0c9f2547",
            "subject": "mexc-partner.com",
            "valid_to": "2026-12-09T16:11:50Z",
            "valid_from": "2026-09-10T16:11:51Z"
        },
        "whois": {
            "registrar": "Megazone Corp., dba HOSTING.KR",
            "registrar_iana_id": "1489",
            "registrar_url": "http://HOSTING.KR",
            "created": "2024-07-25T06:37:20Z",
            "updated": "2026-01-04T03:58:16Z",
            "expires": "2027-07-25T12:00:00Z",
            "status": [
                "clientTransferProhibited",
                "ok"
            ],
            "nameservers": [
                "ns1.hosting.co.kr",
                "ns2.hosting.co.kr",
                "ns3.hosting.co.kr",
                "ns4.hosting.co.kr"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-25T06:37:20Z",
                "last changed": "2026-01-04T12:58:16Z",
                "registration": "2024-07-25T06:37:20Z",
                "last update of RDAP database": "2026-01-04T12:58:16Z"
            }
        }
    }
}
```