tr-mexc[.]co

The domain tr-mexc.co is a phishing site engaged in brand impersonation targeting the cryptocurrency exchange MEXC. It presents itself as the legitimate MEXC platform, using identical branding and language to deceive users into disclosing login credentials or transferring funds. As of the latest verification, tr-mexc.co has been taken offline, though it previously operated as a cryptocurrency scam without an associated drainer kit.

Technical indicators for tr-mexc.co show limited detection at this stage. The domain was flagged by 1 of 1 security blocklists (PhishDestroy) but had 0 of 95 detections on VirusTotal and was not flagged by Google Safe Browsing. It was created on February 21, 2026, and resolved to the IP address 163.181.254.226, hosted under AS24429 in Germany. The SSL certificate was issued by GeoTrust TLS RSA CA G1, and the observed page title was in Turkish, reading 'MEXC Borsası: Kriptoya En Kolay Yolunuz - Bitcoin, Ethereum ve En Trend Token’larla Ticaret Yapın'. Nameservers included AWS DNS endpoints, though registrar details remain unavailable.

Users who interacted with tr-mexc.co should immediately change their MEXC account passwords and enable two-factor authentication to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or login attempts. Report the phishing domain to MEXC’s official support channels and submit it to platforms like PhishTank or Google Safe Browsing to aid in broader takedown efforts. If funds were transferred, contact the relevant cryptocurrency exchange or wallet provider to report the incident and explore recovery options.