rumexc[.]cyou

This domain, rumexc.cyou, is identified as a high-risk brand impersonation threat specifically targeting MEXC, a cryptocurrency exchange platform. The site mimics legitimate MEXC branding to deceive users into disclosing sensitive credentials, such as login details, two-factor authentication codes, or private wallet keys. Analysis indicates the domain is designed to facilitate unauthorized account access or direct asset theft, likely through fraudulent login portals or fake wallet connection prompts. The threat extends to potential crypto drainer functionality, where victims may unknowingly authorize malicious transactions via compromised credentials or deceptive smart contract interactions. Technical evidence confirms the domain's malicious intent. rumexc.cyou was registered on March 09, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. It resolves to the IP address 137.220.131.177 and is flagged by 12 out of 95 security vendors on VirusTotal. The domain appears on three independent security blocklists and is actively blocked by multiple security tools. Infrastructure analysis reveals the use of Vue.js for dynamic content rendering, Nginx as the web server, and support for HSTS and HTTP/3, suggesting an attempt to appear legitimate while maintaining operational security. The page title explicitly displays 'MEXC,' further corroborating the brand impersonation strategy. Users who visited rumexc.cyou should immediately revoke any connected wallet permissions and reset credentials for their MEXC account and associated email addresses. Monitor all linked accounts for unauthorized transactions or login attempts, particularly those involving cryptocurrency wallets. If sensitive information was entered, assume compromise and conduct a full security audit, including checking for malware or unauthorized browser extensions. Report the incident to the legitimate platform and relevant cybersecurity authorities to assist in tracking the threat. Proactively enable multi-factor authentication on all critical accounts and verify domain authenticity before interacting with any exchange-related sites.