mexswin8l[.]top

The domain mexswin8l.top was registered on 29 December 2024 through NameSilo, LLC and is currently hosted behind Cloudflare. DNS resolution points to IP address 104.21.96.1, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The authoritative name servers are katja.ns.cloudflare.com and cody.ns.cloudflare.com. TLS termination is provided by Google Trust Services under the WE1 certificate, and HTTP requests return a 200 status code. The public page title returned by the web server is “Mexswin”. Automated analysis identified the presence of Google Sign‑in, reCAPTCHA, Marked, jsDelivr, Google Tag Manager, Google Analytics, Cloudflare Browser Insights and the Cloudflare edge platform. The domain received a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of abuse. It is listed on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal currently reports zero detections out of ninety‑five scans, which does not constitute evidence of benign behavior. This infrastructure is classified as a brand‑impersonation campaign targeting Facebook, with the scam type recorded as social_media. The evidence confirms that the site is deliberately crafted to lure victims by leveraging Facebook‑related branding, though the exact page content and any credential‑harvesting mechanisms have not been publicly disclosed. Defenders should prioritize DNS‑level blocking of mexswin8l.top, enforce outbound filtering for connections to the associated Cloudflare IP, and monitor for any authentication attempts that reference the Google Sign‑in flow observed on the site. Continuous re‑scanning with multiple malware engines is advised to detect any future malicious payloads that may be introduced.