m[.]mexcbitca[.]com

This domain is flagged for elevated risk due to brand impersonation targeting the cryptocurrency exchange MEXC. Analysis indicates the site is designed to deceive users into believing it is the legitimate MEXC platform, potentially facilitating credential theft or fraudulent transactions. The specific threat type—brand impersonation—is confirmed by the page title 'MEXC,' which matches the official exchange’s branding, alongside infrastructure patterns consistent with malicious activity.

Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on November 30, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. It resolves to IP address 18.140.3.251, hosted on Amazon.com, Inc. (AS16509) in Singapore, a common infrastructure choice for threat actors due to its scalability and anonymity. Security vendors on VirusTotal flagged the domain at a rate of 13/95, while it appears on at least one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying risk. The domain’s recent creation date and immediate flagging by security tools further corroborate its malicious intent.

Mitigation steps for users and organizations include immediate blocking of the domain and its associated IP (18.140.3.251) at the network level. Users who may have interacted with the site should reset credentials for MEXC and any other financial accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update threat intelligence feeds to include this domain and its indicators of compromise (IOCs), such as the registrar (Gname.com Pte. Ltd.) and hosting provider (Amazon AS16509). Security teams are advised to conduct retroactive log analysis to identify any prior engagement with this domain and assess potential exposure.