sgabmexc[.]bond

This domain, sgabmexc.bond, is flagged as a high-risk brand impersonation threat targeting MEXC, a cryptocurrency exchange platform. The site mimics legitimate MEXC login and transaction pages, attempting to harvest user credentials, API keys, and sensitive financial data. Analysis indicates the domain is designed to exploit trust in the MEXC brand, potentially leading to unauthorized account access, fund theft, or further phishing campaigns against victims' contacts. The page title explicitly matches the legitimate MEXC site, increasing the likelihood of successful deception among users familiar with the platform.

Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on April 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with phishing operations. It resolves to the IP address 137.220.131.177, hosted in Japan under Rackip Consultancy Pte. LTD, a provider with a history of hosting fraudulent domains. Security vendors flagged the domain on VirusTotal, with 18 out of 95 engines detecting it as malicious. Additionally, the domain appears on three security blocklists, and Google Safe Browsing classifies it as a phishing site. The SSL certificate, issued by Let's Encrypt (R12), is valid but does not mitigate the inherent risk, as threat actors commonly use legitimate certificates to lend credibility to malicious sites.

Users who visited sgabmexc.bond should take immediate action to mitigate potential compromise. If credentials or API keys were entered, revoke all active sessions and reset passwords for the legitimate MEXC platform and any other services where the same credentials were reused. Enable multi-factor authentication (MFA) on all accounts to prevent unauthorized access. Monitor financial transactions for signs of unauthorized activity and report suspicious behavior to the legitimate platform's support team. If personal or financial data was exposed, consider placing a fraud alert on credit files. Users should also scan their devices for malware, as phishing sites may deploy additional payloads. Finally, verify the legitimacy of any communications claiming to be from MEXC by cross-referencing with official channels.