mexc[.]fm

This domain, mexc.fm, is actively flagged as a confirmed crypto scam impersonating the MEXC cryptocurrency exchange. Registered on February 21, 2026, through Gandi SAS, the domain resolves to the IP address 3.114.111.22, hosted on AWS EC2 infrastructure in the ap-northeast-1 region (Japan). The page title, 'MEXC Exchange: Your Easiest Way to Crypto - Trade Bitcoin, Ethereum & Most Trending Tokens,' explicitly mimics the branding and messaging of the legitimate MEXC platform, aligning with the documented scam type of crypto fraud. Nameservers are distributed across AWS DNS services, a common tactic to enhance resilience against takedowns. The domain currently returns an HTTP 301 redirect status, which may indicate an attempt to obscure its final destination or evade detection. Infrastructure analysis reveals the domain is blocked by at least one security vendor (PhishDestroy) and appears on a single security blocklist. While 93 vendors have scanned the domain via VirusTotal, none currently flag it as malicious; however, the absence of detections does not confirm legitimacy. The SSL certificate is issued by WE1, a provider frequently observed in both legitimate and malicious domains. Defenders should note that the domain remains active as of July 12, 2026, and is under investigation for further risk assessment. Organizations are advised to treat this domain as high-risk, particularly those in the cryptocurrency sector. Immediate actions should include blocking the domain and its associated IP (3.114.111.22) at the network perimeter, monitoring for internal connections, and alerting users to the impersonation threat. Given the domain's recent registration and active status, continued monitoring for changes in infrastructure or detection status is recommended.