mexce[.]site

PhishDestroy identifies mexce.site as an active brand impersonation phishing domain targeting the cryptocurrency exchange MEXC. This deceptive site leverages typographical manipulation—replacing 'c' with 'e'—to appear credible to unsuspecting users seeking legitimate platform access. The page title is identical to MEXC’s official interface, indicating intentional mimicry designed to harvest login credentials and personal data under the guise of a trusted service. This domain was flagged under investigation with a confirmed risk level due to multiple observable indicators compiled via automated analysis. The domain was registered on April 22, 2026, through GoDaddy.com, LLC, a commonly used registrar that does not inherently indicate malicious intent but is frequently exploited in domain spoofing campaigns. The site utilizes a legitimate SSL certificate issued by Let’s Encrypt, giving it a false appearance of security. Currently hosted on IP 172.67.205.233, it remains undetected by VirusTotal with 1 out of 95 security engines flagging it as malicious at the time of analysis. This low detection rate suggests either a recently deployed campaign or evasion tactics such as delayed malicious payload delivery or cloaking based on geolocation or user-agent. Users who have visited mexce.site are strongly advised not to enter any sensitive information including usernames, passwords, or financial details. If credentials were submitted, immediately change passwords on the official MEXC platform and enable two-factor authentication. Report the domain to your organization’s security team or through platforms like Google Safe Browsing, PhishTank, or directly to MEXC’s abuse desk. Clear your browser cache and cookies related to this domain to prevent persistent tracking. Exercise heightened caution with domains exhibiting minor spelling variations or recent registrations, especially those mimicking financial or cryptocurrency services.