indimexconstructions[.]store

Analysis of the domain indimexconstructions.store indicates a confirmed brand impersonation campaign targeting MEXC, a cryptocurrency exchange platform. The domain was registered on August 23, 2025, through IONOS SE, and remains active as of July 12, 2026. It resolves to the IP address 74.208.236.198, which has been associated with other malicious infrastructure in threat intelligence pulses. While the page title matches the domain name itself, the domain is explicitly flagged for MEXC impersonation, suggesting an intent to deceive users into believing they are interacting with the legitimate exchange. Security vendor detection remains limited but notable, with 2 out of 95 engines on VirusTotal identifying the domain as malicious. Additionally, the domain appears on two security blocklists and is recognized in 23 threat intelligence pulses within AlienVault OTX, further corroborating its malicious classification. The Gridinsoft trust score of 0/100 reinforces the high-risk assessment, though specific details about the phishing kit or exact attack vector remain unconfirmed. The lack of widespread detection does not diminish the threat, as targeted impersonation campaigns often evade broader scrutiny until later stages of operation. Defenders should prioritize blocking this domain at the DNS and network levels, particularly within environments where cryptocurrency-related activity occurs. The domain’s registration age—nearly a year old—suggests it may have evaded earlier detection through low-volume or highly targeted deployment. Given its active status and confirmed impersonation of a major exchange, monitoring for related domains or IP associations is recommended. While the exact content of the site has not been analyzed, the available indicators align with typical phishing infrastructure, warranting immediate containment measures.