fi-bau[.]com

The domain fi-bau.com was registered on 21 February 2026 through IONOS SE. It resolves to the IPv4 address 217.160.0.28, which belongs to the AS8560 network operated by IONOS SE in Germany. No TLS certificate is presented, and HTTP requests return a 200 OK status with the page title “fi-bau.com”. The authoritative name servers are ns1046.ui-dns.com, ns1061.ui-dns.de, ns1093.ui-dns.org, and ns1122.ui-dns.biz, all associated with the same registrar. The site is flagged as an impersonation of the cryptocurrency exchange MEXC.

VirusTotal has recorded nine positive detections out of ninety‑three scanned engines, indicating that multiple security vendors have identified malicious behavior. The domain appears on three public blocklists and is currently listed by PhishDestroy, MetaMask, and SEAL as a malicious resource. Independent scoring services assign a Gridinsoft trust rating of 0 out of 100, reinforcing the assessment of high risk. The lack of SSL, combined with the presence of a generic page title and the use of reputable hosting infrastructure, suggests the operators are leveraging a trusted hosting provider to increase credibility while avoiding the overhead of certificate management.

At this time the content of the site beyond the title has not been publicly disclosed, so the exact phishing technique and page structure remain unknown. Defenders should block network traffic to 217.160.0.28, add fi-bau.com to domain‑based deny lists, and monitor for related sub‑domains or future registrations that reuse the same name‑server set. Incident response teams encountering credential submissions or transaction requests tied to MEXC should treat them as compromised and initiate credential rotation. Continuous monitoring of VirusTotal, blocklist updates, and any emerging threat‑intel feeds is recommended to capture potential shifts in the campaign’s infrastructure.