mexc-listing[.]fun

This domain, mexc-listing.fun, is identified as a brand impersonation phishing site specifically targeting users of the MEXC cryptocurrency exchange platform. Analysis confirms the domain was actively impersonating MEXC, presenting itself as an official listing or trading portal to mislead visitors into disclosing sensitive credentials or transferring assets. The current status of the domain is offline, though prior activity warrants continued monitoring. Infrastructure analysis reveals the domain was created on April 16, 2026, and resolved to the IP address 104.21.84.79. It was flagged by 4 of 95 security vendors on VirusTotal and appeared on three distinct security blocklists, indicating broad recognition of its malicious nature. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Additional technical indicators include a Gridinsoft trust score of 0/100, a Let's Encrypt SSL certificate, and the use of Cloudflare services alongside Node.js, Vue.js, and Nuxt.js frameworks. The page title explicitly displayed 'MEXC,' further reinforcing its impersonation tactics. Given the elevated risk level and confirmed brand impersonation, users and organizations are advised to treat this domain as a confirmed threat vector. Immediate actions include blocking the domain and its associated IP (104.21.84.79) at the network perimeter, updating endpoint protection rules, and conducting internal audits for any prior exposure. Security teams should also monitor for newly registered domains with similar naming patterns or infrastructure, particularly those leveraging the same registrar or hosting providers. Users who may have interacted with the domain should reset credentials and review transaction histories for unauthorized activity.