h5[.]mexc[.]stream

On 24 July 2026, the domain h5.mexc.stream was observed pointing to IP 45.192.98.52, which is registered to AS401701 (cognetcloud INC) in Hong Kong. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and uses the authoritative name servers a9.share-dns.com and b9.share-dns.net. No TLS certificate is presented, indicating the site is served over plain HTTP. The page title returned by the server is "MEXC‑ZH", and the threat intelligence tags the activity as a crypto‑scam that impersonates the MEXC exchange. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single external blocklist.

PhishDestroy has also listed the domain as blocked, and the current operational status is offline. VirusTotal records show that the domain was scanned by 93 security vendors; none of the scanners currently flag the host, but the absence of detections does not constitute a safety guarantee. The limited detection footprint, combined with the lack of SSL, suggests a low‑cost infrastructure often employed in short‑lived impersonation campaigns. The registrar Gname.com Pte. Ltd. is a known bulk‑registration provider, which can impede rapid takedown.

Uncertainty remains regarding the exact content that was hosted before the takedown, as no page capture is available. Analysts should continue to monitor the IP address 45.192.98.52 for re‑use, and consider adding the domain to internal blocklists despite the current offline state. Defensive actions include enforcing DNS filtering of the domain and its name servers, updating web‑gateway policies to block HTTP traffic to the IP, and reviewing any recent authentication attempts against MEXC accounts for potential credential harvesting. Ongoing observation of the registrar and ASN for new registrations may provide early warning of similar campaigns.