mexc168[.]qpon

The domain mexc168.qpon was registered on September 08, 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare IPv6 address 2606:4700:3032::6815:3774, placing the infrastructure in the United States under ASN13335. The domain is configured with Cloudflare nameservers ian.ns.cloudflare.com and nelly.ns.cloudflare.com, but it does not present an SSL/TLS certificate, indicating that HTTPS connections are not secured. The site’s page title is reported as "MEXC-AI," and the domain is explicitly marked as impersonating Google, aligning with a crypto‑scam classification.

Current monitoring shows the domain is offline, and it has been added to a single security blocklist, where it is listed by PhishDestroy. VirusTotal scans have returned three detections out of ninety‑five antivirus engines, and Gridinsoft assigns a trust score of zero out of one hundred, both reinforcing the malicious assessment. No additional public threat intelligence (OTX, Safe Browsing, or similar) is cited for this host.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑activation of the host. Given the lack of SSL and the low trust score, any attempt to access the domain would be unsafe. Analysts should also watch for related domains that use similar naming patterns or the same registrar, as the infrastructure suggests a low‑cost, rapidly deployed phishing campaign targeting Google users with crypto‑related bait.