aramexciam[.]ciamlogin[.]com

The domain aramexciam.ciamlogin.com is currently active and identified as a high-risk threat, specifically for brand impersonation. It targets the cryptocurrency exchange brand MEXC, attempting to deceive users into believing they are interacting with a legitimate MEXC service.

Analysis indicates that the domain has been flagged by 5 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion. The domain is registered through MarkMonitor Inc., a registrar known for managing high-value domains. It resolves to the IP address 40.126.31.3, which is located in Ireland (IE) and is associated with Microsoft Azure Active Directory (northeurope). The domain was created on March 25, 2026, and appears on one known security blocklist, further indicating its malicious intent. The page title, 'Sign in to your account,' is consistent with typical phishing tactics used to lure users into providing sensitive information.

The domain remains active as of the latest assessment. While it is blocked by PhishDestroy, users are still at risk if they bypass this block or access the site through other means. Given the high risk level and the use of a trusted registrar and infrastructure, it is recommended that users avoid this domain and report any related phishing attempts to the relevant authorities and the MEXC security team.