mexswin-6k[.]top

This domain, mexswin-6k.top, is actively flagged as a high-risk brand-impersonation phishing site targeting Facebook users. Registered on December 29, 2024, through NameSilo, LLC, the domain resolves to IP address 172.67.220.221, hosted on Cloudflare’s network (AS13335) in the United States. Analysis indicates the site is still operational, returning an HTTP 200 status, with a page title of 'Mexswin.' While the exact content of the site remains unconfirmed, the domain is explicitly categorized as a social media scam, aligning with its designation as a Facebook impersonation attempt. Infrastructure analysis reveals the use of Cloudflare nameservers (cody.ns.cloudflare.com and katja.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). Detected technologies include Google Sign-in, reCAPTCHA, Google Tag Manager, Google Analytics, jsDelivr, Marked, and HTTP/3, suggesting an attempt to mimic legitimate authentication and tracking mechanisms. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Seven out of ninety-five security vendors on VirusTotal have flagged the domain as malicious, though the remaining vendors have not yet classified it, leaving some uncertainty about its detection coverage. Defenders should treat this domain as an active threat. The combination of a recent registration, Cloudflare hosting, and the use of common web technologies to simulate legitimacy is consistent with phishing infrastructure. Network-level blocking of 172.67.220.221 and monitoring for connections to mexswin-6k.top are recommended. Given the domain’s association with Facebook impersonation, security teams should prioritize alerting users to potential credential theft or account compromise attempts originating from this source. Further analysis of the site’s content, if accessible, would clarify the specific phishing tactics employed, but current indicators warrant immediate containment measures.