mexswin-q3[.]top

The domain mexswin-q3.top was registered on 2024-12-29 through NameSilo, LLC and currently resolves to the IPv6 address 2606:4700:3030::6815:4001, hosted by a US‑based infrastructure provider (AS13335). The site serves HTTP 200 responses and presents a TLS certificate issued by a major public certificate authority. Nameserver delegation points to two Cloudflare‑managed resolvers. Page metadata reports a title of "Mexswin" and the domain is classified as a brand‑impersonation campaign targeting Facebook, employing a social‑media scam vector. Security telemetry shows nine of ninety‑five scanners flag the domain, and it is listed on a single blocklist that has already taken action via PhishDestroy. Observed web components include an authentication flow, CAPTCHA challenge, third‑party script delivery, tag management, analytics collection, and use of HTTP/3 over a CDN. The overall risk rating is high and the campaign remains active. Current gaps include the lack of publicly released payload samples or detailed phishing page screenshots, limiting assessment of credential‑harvesting techniques. Defenders should block the domain at network perimeter, update detection signatures to include the observed IPv6 address and the specific registrar and nameserver patterns, and monitor for any related traffic to the associated CDN edge. Continuous re‑evaluation is advised as additional threat intelligence, such as expanded malware detections or new blocklist entries, becomes available.