# xibumexc.icu — SUSPICIOUS

> xibumexc.icu impersonates MEXC with a crypto drainer. VirusTotal shows 0/95 detections. Verify on PhishDestroy and never enter wallet details.

## Summary
PhishDestroy identifies xibumexc.icu as an active crypto drainer impersonating the MEXC brand. This domain is designed to trick users into connecting crypto wallets and signing malicious transactions that drain funds. The site mimics MEXC’s branding to appear legitimate, but it is not affiliated with the exchange in any way.  This domain was flagged after VirusTotal scans returned 0 detections out of 95 security engines, indicating it has evaded detection by most antivirus tools. The domain xibumexc.icu was registered on April 08, 2026, through Gname.com Pte. Ltd., a registrar often abused by threat actors for short-lived malicious domains. It resolves to IP address 202.79.166.175 and uses a Let’s Encrypt SSL certificate, which adds a false sense of security by appearing valid.  If you visited xibumexc.icu, do not connect your wallet or enter any credentials. Revoke any permissions granted to unknown domains immediately using your wallet’s security settings. Scan your device for malware and consider rotating private keys if you interacted with the site. Report the domain to PhishDestroy and your wallet provider to help block further attacks.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: MEXC

## Domain Intelligence
- Registered: 2026-04-08 07:18:06
- Registrar: Gname.com Pte. Ltd.
- IP: 202.79.166.175

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/xibumexc.icu
- PhishDestroy: https://phishdestroy.io/domain/xibumexc.icu/
- LLM endpoint: https://phishdestroy.io/domain/xibumexc.icu/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xibumexc.icu/
Last updated: 2026-04-09