mexcopo[.]cc

This domain, mexcopo.cc, is identified as a brand impersonation threat targeting the cryptocurrency exchange MEXC. Analysis indicates the site was designed to deceive users into believing they were accessing the legitimate MEXC platform, likely to harvest credentials or facilitate unauthorized transactions. The page title explicitly displayed 'MEXC,' reinforcing the fraudulent branding, though no specific drainer kit signatures were confirmed in the available telemetry. Infrastructure analysis reveals the domain was registered on September 10, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.97.3, a Cloudflare-hosted endpoint, which may have been leveraged to obfuscate the true origin of the malicious activity. At the time of detection, the domain was flagged by 7 out of 95 security vendors on VirusTotal, indicating moderate to elevated suspicion. It appeared on a single security blocklist, and the Gridinsoft trust score was 0/100, further corroborating its malicious classification. The site employed technologies such as Vue.js, HSTS, and Cloudflare Browser Insights, which are not inherently malicious but are often exploited to enhance the perceived legitimacy of phishing pages. As of the latest assessment, mexcopo.cc has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the risk of reemergence remains elevated, as threat actors frequently re-deploy similar infrastructure under new domains. Users who may have interacted with this domain are advised to immediately revoke any active sessions, reset credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while also educating users on identifying brand impersonation tactics in cryptocurrency-related communications.