coinex[.]mexcbtc[.]com

On July 24, 2026, the domain coinex.mexcbtc.com was observed to be taken offline. The domain was registered on March 03, 2025 through GoDaddy.com, LLC and uses the default GoDaddy nameservers ns05.domaincontrol.com and ns06.domaincontrol.com. DNS resolution points to the IPv4 address 43.129.163.197, which belongs to AS132203 located in Hong Kong and is associated with a Tencent building on Kejizhongyi Avenue. The hosting server presents an SSL certificate issued by sslTrus / sslTrus (RSA) DV CA, indicating a domain‑validated certificate without extended validation. The HTTP response includes HSTS and HTTP/3 headers, and the underlying web stack was identified as Nginx serving PHP applications built with ThinkPHP, Vue.js, jQuery, and other common libraries.

The page title returned by the server is “MEXC”, matching the brand target “mexc”. This aligns with the classified threat type of brand impersonation. VirusTotal scans recorded two detections out of ninety‑five vendors, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, while Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence that the site is malicious. No additional public intelligence such as OTX references or Safe Browsing entries were provided.

Analysis indicates that the infrastructure was deliberately crafted to mimic the legitimate MEXC brand, likely to harvest credentials or lure users into fraudulent transactions. The short lifespan—registration less than a year before takedown—suggests a rapid‑deployment campaign. Uncertainty remains regarding the specific phishing kit or payload used, as the content of the landing page has not been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP or hosting ASN, and update detection rules to flag requests for the “MEXC” page title originating from this host.