mexcror[.]cc

The domain mexcror.cc has been identified as a confirmed brand impersonation site targeting the cryptocurrency exchange MEXC. Analysis indicates this domain was designed to mimic the legitimate platform, likely to facilitate credential harvesting or fraudulent transactions. As of the latest assessment, the domain is offline, though prior activity suggests it operated as a high-risk impersonation endpoint. Infrastructure analysis reveals the domain was registered on September 10, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. It resolved to the IP address 104.21.14.216 and employed Cloudflare services, including HTTP/3 and HSTS, to obfuscate its origin and enhance perceived legitimacy. Detection metrics show the domain was flagged by 1 of 95 security vendors on VirusTotal, while appearing on a single security blocklist. Additional indicators include a Gridinsoft trust score of 0/100 and the use of a Google Trust Services SSL certificate, further corroborating its malicious classification. The page title explicitly mirrored the legitimate MEXC brand, reinforcing its deceptive intent. Given the domain's current offline status, immediate threats to end users are mitigated. However, organizations and individuals are advised to treat any prior interactions with mexcror.cc as compromised. Security teams should update blocklists to include this domain and its associated IP address, while monitoring for re-registration or similar impersonation attempts. Users who accessed the site should revoke active sessions, reset credentials, and inspect connected devices for unauthorized activity. Proactive measures, such as domain monitoring and phishing awareness training, are recommended to mitigate future risks from similar campaigns.