mercoinpro[.]com

This domain, mercoinpro.com, is actively engaged in brand impersonation targeting Binance, a major cryptocurrency exchange. Analysis indicates the site presents itself as an official German platform, using the page title 'MercoinPro - Offizielle Website in Deutschland [2025]' to deceive users into believing it is a legitimate regional service. The threat type is classified as brand impersonation with a high likelihood of credential theft or crypto asset compromise, given the targeted nature of the deception and the use of localized content. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through Gransy, s.r.o., and currently resolves to the IP address 172.67.214.200, hosted on Cloudflare’s AS13335. It lacks an SSL certificate, increasing the risk of man-in-the-middle attacks. The domain is flagged by 9 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. Google Safe Browsing explicitly designates it as a phishing site, further corroborating its malicious intent. As of the latest verification, mercoinpro.com remains active and continues to pose a significant risk to users. The domain has been blocked by multiple security mechanisms, including PhishDestroy, MetaMask, and SEAL, indicating broad recognition of its threat status. Users are advised to avoid interacting with the domain and to verify the authenticity of any cryptocurrency-related websites through official channels. Organizations should update their blocklists to include this domain and monitor for related infrastructure that may emerge as part of the same campaign.