mexc-listings[.]fun

PhishDestroy identifies mexc-listings.fun as an active brand impersonation threat targeting MEXC exchange users. This domain was flagged due to its deliberate misuse of the MEXC brand to deceive visitors into revealing sensitive credentials or cryptocurrency assets. The risk level is currently under investigation, but the presence of confirmed impersonation tactics demands immediate attention from security teams and end-users alike. The domain leverages a high-risk naming strategy, embedding 'MEXC' to exploit brand recognition and establish false legitimacy. This domain exhibits multiple red flags confirmed by PhishDestroy’s analytical pipeline. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 18, 2026, mexc-listings.fun resolves to IP address 172.67.205.141 and is secured with a Let's Encrypt SSL certificate. Despite its recent creation, the domain has not yet been detected by VirusTotal (0 detections out of 95 engines as of latest scan). This low detection rate is concerning, as it suggests the domain may be flying under the radar of automated security tools. The combination of a newly registered domain, high-risk registrar, and absence of blocklist coverage creates a potent threat vector for credential theft and financial fraud. Mitigation against this MEXC impersonation campaign requires coordinated action. Users should immediately cease interacting with mexc-listings.fun and verify all links via official MEXC domains (e.g., mexc.com). Organizations are advised to block the domain at DNS and network levels using the IP 172.67.205.141 and domain name mexc-listings.fun. Security teams should also update phishing blocklists and educate users about recognizing impersonation domains that mimic legitimate exchanges. Proactive monitoring of newly registered domains containing 'MEXC' is recommended to prevent further exploitation. Given the domain’s low detection score and high-risk profile, immediate containment is critical to prevent widespread victimization.