h5[.]mexc[.]bet

Analysis indicates that the domain h5.mexc.bet was registered on 21 February 2026 and is currently offline. The site presented the page title “MEXC‑ZH”, aligning with the targeted brand MEXC, and is classified as a crypto‑scam impersonation. The TLS certificate issued by Sectigo Public Server Authentication CA DV R36 confirms the use of a valid‑looking HTTPS connection, which can aid social engineering. DNS resolution points to IP 45.192.98.52, an address owned by cognetcloud INC in Hong Kong (AS401701). The same IP host has been referenced by PhishDestroy and appears on one external security blocklist, suggesting prior malicious usage.

VirusTotal analysis shows that the domain was scanned by 93 antivirus and URL‑reputation engines, none of which raised a detection at the time of scanning; however, the absence of detections does not guarantee that the content was benign. The domain is listed as a brand‑impersonation attempt targeting MEXC and is associated with a crypto‑scam vector. No additional evidence such as Safe Browsing or Open Threat Exchange entries were observed, and the registrar details are not disclosed in the provided data. Because the domain is already offline, immediate mitigation focuses on preventing re‑use of the same infrastructure.

Defenders should add h5.mexc.bet and its resolving IP 45.192.98.52 to network‑level deny lists, update URL filtering policies to block any future resolution of the domain, and monitor for newly registered sub‑domains under the same registrar or similar naming patterns. Continuous watch of the associated ASN (AS401701) for anomalous traffic toward cryptocurrency services is advised. Threat intel feeds should be updated to reflect the brand‑impersonation classification, and incident response teams should be prepared to investigate any user reports that reference the MEXC brand combined with the “ZH” suffix.