p2plivepayment[.]com[.]exchange-trademarket[.]com

p2plivepayment.com.exchange-trademarket.com is currently offline but was observed hosting a page titled “Index of /”. The domain was registered on February 21 2026 and resolves to the IP address 198.12.80.250, which belongs to HostPapa (AS36352) located in the United States. No TLS certificate was presented, indicating that the site operated only over HTTP. Reputation services show a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist.

PhishDestroy has already blocked the host, and the site was flagged by ten of ninety‑three VirusTotal scanners, reinforcing a malicious classification. The listed scam type is “Crypto Scam” and the domain explicitly impersonates the cryptocurrency exchange MEXC. The presence of the generic directory listing page title suggests that the attacker may have intended to host downloadable payloads or lure victims to a landing page, but the exact content was not captured before takedown. Because the domain is associated with a known crypto‑focused brand impersonation campaign, defenders should add the host to network‑level blocklists, monitor DNS queries for the domain and its resolved IP, and enforce HTTPS‑only policies to prevent accidental connections to non‑TLS endpoints.

Threat intelligence feeds that reference the domain should be updated to reflect the current offline status while retaining historical indicators for future correlation. Uncertainty remains around the specific phishing kit or payload used, as no additional artifacts such as HTML source or JavaScript were released. Continued observation of the IP address and any re‑registration attempts is recommended.