weex-us[.]com

This domain, weex-us.com, is actively impersonating the WEEX investment platform as part of a high-risk investment scam. Registered on May 17, 2026, through NameSilo, LLC, the site presents itself as a "One-Stop Global Investment Platform" offering forex, commodities, stocks, indices, cryptocurrencies, gold, and oil trading. The page title explicitly mirrors legitimate investment service branding, increasing the likelihood of successful deception. Analysis indicates the domain is designed to exploit trust in financial trading platforms, targeting individuals seeking investment opportunities. Infrastructure analysis reveals the domain resolves to 104.21.46.142, an IP address associated with Cloudflare's network (AS13335). The use of Cloudflare nameservers (lloyd.ns.cloudflare.com and monroe.ns.cloudflare.com) and technologies such as Node.js, Vue.js, Express, and HTTP/3 suggests a professionally developed front-end designed to appear legitimate. The site employs a Let's Encrypt SSL certificate (E7) and enforces HSTS, further mimicking secure financial platforms. Despite these security measures, the domain has been flagged by 15 out of 95 security vendors on VirusTotal, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Threat intelligence confirms the domain's malicious intent, with AlienVault OTX listing it in two pulses. The site remains active as of July 12, 2026, serving content with a 200 HTTP status code. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where financial services or investment-related activities are conducted. Monitoring for similar domains using the same infrastructure or registration patterns may help identify related threats. Given the high-risk classification and confirmed impersonation of a financial platform, organizations should treat this domain as a credible threat to users and clients.