me-erc20[.]cc

This domain, me-erc20.cc, is identified as a high-severity brand impersonation threat targeting Ethereum cryptocurrency users. Analysis indicates the site masquerades as an official ETH staking or liquidity pool service, using the page title 'ETH Pool' to lure victims. No direct evidence of a crypto drainer kit was observed, but the domain's infrastructure and branding align with known tactics for unauthorized asset transfer or credential harvesting in the cryptocurrency ecosystem. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 12, 2025, through Gname.com Pte. Ltd. and resolves to IP address 47.251.23.208, hosted on AS45102 (Alibaba US Technology Co., Ltd.). Google Safe Browsing explicitly flags the domain as phishing, while VirusTotal reports 17 out of 95 security vendors detecting malicious activity. The domain appears on one confirmed security blocklist and uses a Let's Encrypt R13 SSL certificate, which provides no inherent trust beyond basic encryption. The rapid detection by multiple vendors suggests the threat was active and recognizable shortly after deployment. As of the latest verification, me-erc20.cc has been taken offline, likely following enforcement actions by hosting providers, registrars, or security response teams. While the immediate threat is mitigated, residual risk remains for users who may have interacted with the domain during its active window. Organizations and individuals are advised to block the domain and IP at perimeter defenses, revoke any credentials or wallet authorizations potentially exposed to the site, and monitor transaction histories for unauthorized activity. Cryptocurrency users should verify all staking or liquidity pool services through official Ethereum channels before engaging with any third-party platforms.