dopemex[.]com

This domain, dopemex.com, is actively impersonating the MEXC cryptocurrency exchange platform under the guise of an "Elon Musk’s Official Crypto Casino Powered by Blockchain." The threat type is classified as brand impersonation, designed to deceive users into believing the site is affiliated with legitimate entities, including high-profile figures and established crypto services. No direct evidence of a crypto drainer kit has been observed, but the site’s structure and claims suggest intent to harvest credentials or facilitate fraudulent transactions. The page title explicitly leverages Elon Musk’s name and blockchain technology to lend false credibility, a common tactic in crypto-related scams targeting unsuspecting investors. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on May 12, 2024, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.20.210, which is part of a network known for hosting malicious content. The domain is flagged by 16 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It appears on two security blocklists (PhishDestroy and OISD) and has a Gridinsoft trust score of 1 out of 100, further corroborating its fraudulent nature. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Additional technologies detected include tracking and analytics tools such as Twitter Ads, Facebook Pixel, and Cloudflare Browser Insights, which are often used to monitor user behavior and optimize fraudulent campaigns. The domain remains active and poses an elevated risk to users, particularly those familiar with MEXC or interested in crypto-related promotions. Current response actions include its inclusion on multiple blocklists, which may limit its reach but do not fully mitigate the threat. Users are advised to avoid interacting with the site, as it may lead to financial loss, credential theft, or exposure to malware. Organizations should update their security controls to block access to this domain and monitor for similar impersonation attempts targeting crypto platforms. The remaining risk is significant due to the domain’s active status and the sophisticated social engineering tactics employed, which may bypass technical safeguards for less vigilant users.