phemexcoins[.]cc

This domain, phemexcoins.cc, is flagged as a brand impersonation phishing site targeting users of the MEXC cryptocurrency exchange. The page title, Phemexcoin, mimics legitimate exchange branding to deceive victims into disclosing credentials or transferring assets. No specific drainer kit signatures were identified, but the use of Vue.js and Cloudflare infrastructure suggests an attempt to evade detection while maintaining operational resilience. The domain exhibits characteristics consistent with cryptocurrency phishing campaigns, including the use of homoglyphs and misleading branding elements. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3 and was registered through Dynadot Inc on May 31, 2026. It is flagged by 5 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services, and the domain is currently offline. Additional detections include two threat intelligence pulses on AlienVault OTX and a Gridinsoft trust score of 0/100, indicating high confidence in its malicious nature. The domain has been taken offline, likely due to enforcement actions by security providers or hosting interventions. Despite its current inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for credential reuse or unauthorized transactions linked to this domain. Affected users should revoke active sessions, rotate passwords, and verify wallet addresses for signs of compromise. Proactive monitoring of newly registered domains with similar naming patterns is recommended to mitigate future threats.