h5[.]mexc[.]monster

The domain h5.mexc.monster is a confirmed phishing site engaged in brand impersonation targeting MEXC, a cryptocurrency exchange. It operates as a cryptocurrency scam, presenting itself as the legitimate MEXC platform to deceive users into disclosing sensitive information or transferring funds. No drainer kit was identified in this case. The site is currently taken offline, but its previous activity poses a risk to users who may have interacted with it.

Technical analysis of h5.mexc.monster reveals limited detection at this stage, with 0 of 95 VirusTotal vendors flagging the domain. The domain was created on February 21, 2026, and resolves to the IP address 45.192.98.52, hosted in Hong Kong under AS401701 (cognetcloud INC). It appears on 1 security blocklist, specifically PhishDestroy. The SSL certificate is issued by Sectigo Public Server Authentication CA DV R36, and the observed page title was 'MEXC-ZH'. Google Safe Browsing has not flagged the domain, and no registrar information is available.

Users who may have interacted with h5.mexc.monster should take immediate steps to secure their accounts and assets. For cryptocurrency-related scams, revoke any token approvals granted to suspicious sites and transfer funds to a new wallet. If login credentials were entered, change passwords immediately and enable two-factor authentication (2FA) on all related accounts. Monitor accounts for unauthorized transactions or signs of fraud. Report the phishing domain to the impersonated brand (MEXC) and relevant authorities, such as local cybercrime units or platforms like the Anti-Phishing Working Group (APWG).