mexc168[.]shop

This domain is flagged as an elevated-risk crypto brand impersonation threat targeting users of the base platform. Analysis indicates the site operated as a fraudulent cryptocurrency portal, likely designed to harvest credentials or deploy wallet-draining scripts under the guise of a legitimate exchange. The infrastructure exhibits multiple high-confidence indicators of malicious activity, aligning with known phishing tactics in the cryptocurrency sector.

Infrastructure analysis reveals the domain mexc168.shop was registered on September 08, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with newly created phishing domains. It resolves to IP address 172.67.220.191, hosted on Cloudflare’s network (AS13335) in the United States, a common obfuscation tactic to mask origin servers. The domain is detected by 9 out of 95 security vendors on VirusTotal, with one active blocklist entry confirming its malicious classification. The page title, MEXC-AI, suggests an attempt to mimic the MEXC exchange while incorporating trending AI-related lures. Notably, the domain lacks an SSL certificate, a red flag for user security and a deviation from standard practices for legitimate financial platforms.

Mitigation requires immediate action from security teams and end users. Network-level blocking of the domain and its resolving IP (172.67.220.191) is recommended to prevent access. Cryptocurrency users should verify exchange URLs against official sources, enable multi-factor authentication, and avoid interacting with unsolicited links or AI-themed promotions. Wallet software should be configured to reject connection requests from untrusted domains. Given the domain’s offline status, monitoring for re-registration or related infrastructure (e.g., mexc168.shop variants) is advised, as threat actors often recycle naming conventions across campaigns.