mexcyd-cot[.]top

Analysis of mexcyd-cot.top indicates the site was registered on February 21, 2026 through Gname.com Pte. Ltd. The authoritative nameservers are a11.share-dns.com. and b11.share-dns.net., which resolve to a hosting provider in Hong Kong identified as AS142403 YISU CLOUD LTD with the IP address 39.109.117.4. The domain presents a Let’s Encrypt TLS certificate (R11), confirming the presence of a valid but freely issued SSL chain. The HTTP response returns the page title “mexcyd-cot.top”, and the domain is explicitly catalogued as impersonating the cryptocurrency exchange MEXC in a crypto‑scam campaign.

Google Safe Browsing classifies the URL as social engineering, and VirusTotal reports 11 detections out of 95 scanning engines, providing moderate to high confidence of malicious behavior. The domain appears on one external security blocklist and has been added to the PhishDestroy blocklist, confirming that at least one industry sinkhole has taken mitigation action. Current HTTP status is offline, indicating that the malicious site is no longer reachable, either due to takedown or host removal. The evidence confirms the infrastructure, branding abuse, and risk rating (high) but does not reveal the exact content of the landing page, the phishing kit version, or any credential‑harvesting mechanisms because the site is not accessible.

Defenders should continue to monitor DNS queries for mexcyd-cot.top and its associated nameservers, enforce outbound filtering for the IP 39.109.117.4, and ensure web‑gateway and email security solutions block URLs flagged by Google Safe Browsing and VirusTotal. Adding the domain and its IP to internal blocklists, as well as sharing the indicator set with threat‑intel platforms, will reduce the likelihood of accidental user exposure. Given the confirmed brand impersonation and crypto‑scam classification, any traffic to this domain should be treated as malicious and denied.