mexcwl[.]com

The domain mexcwl.com is a confirmed phishing site engaged in brand impersonation targeting MEXC, a cryptocurrency exchange. It was designed to deceive users into believing they were interacting with the legitimate MEXC platform, posing an elevated risk of credential theft or fraudulent transactions. No drainer kit was identified, but the site was actively flagged for social engineering before being taken offline.

Technical indicators confirm mexcwl.com as malicious. As of analysis, 2 of 95 VirusTotal security vendors detected the domain, including SOCRadar and Trustwave. Google Safe Browsing flagged it for 'SOCIAL_ENGINEERING,' and it appeared on three security blocklists: PhishDestroy, MetaMask, and SEAL. The domain was registered on February 24, 2026, through Gname.com Pte. Ltd. and resolved to IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335) in the US. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'MEXC.' Technologies detected included Vue.js, Cloudflare, and HTTP/3. Gridinsoft assigned a trust score of 0/100, further validating its malicious nature.

Users who interacted with mexcwl.com should immediately change their MEXC account passwords and enable two-factor authentication. Monitor accounts for unauthorized transactions or login attempts. If cryptocurrency was involved, revoke any token approvals granted to unknown contracts and consider transferring funds to a new wallet. Report the domain to MEXC’s official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.