pcrtal[.]tmgmexchanges[.]vip

The domain pcrtal.tmgmexchanges.vip has been identified as a crypto‑related brand‑impersonation site targeting users of the MEXC exchange. The site was registered on August 17, 2025 through Gname.com Pte. Ltd. and is served from the IP address 116.204.186.140, which belongs to AS9294 GNET INC. in Hong Kong. Technical fingerprints show a stack consisting of Vue.js front‑end components delivered via unpkg, an Nginx web server, enforcement of HTTP Strict Transport Security, and support for HTTP/3.

The page title returned by the now‑offline host was "Coincheckusa," indicating an attempt to disguise the content under a different cryptocurrency brand. Nameserver records point to a9.share-dns.com and b9.share-dns.net. The domain appears on three independent security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded detections from two of ninety‑four scanning engines, providing additional confirmation of malicious intent.

Although the site is currently taken offline, defenders should continue to enforce network‑level blocking of the domain and its associated IP address, monitor for any resurgence of the host, and apply threat‑intel updates to endpoint protection solutions. Logs should be examined for any prior connections to the IP or DNS queries for the domain, especially from users who interact with MEXC services. Because the site leveraged legitimate web technologies, static content analysis alone may be insufficient; correlating traffic patterns with the known HSTS and HTTP/3 usage can aid in distinguishing legitimate MEXC traffic from this impersonation attempt. Ongoing vigilance for newly registered domains using similar name‑server pairs or the same hosting ASN is recommended to pre‑empt future impersonation campaigns.