mainnetfixrelay[.]top

This report details the threat posed by the domain mainnetfixrelay.top. Based on its page title, "Index of /", the site presents a generic directory listing. This indicates the domain was likely set up as a staging area for malicious files or a phishing kit, rather than a functional website. The domain name, featuring "fixrelay" and "mainnet", suggests an attempt to impersonate blockchain or cryptocurrency network support services, posing a risk of credential theft or malware distribution to users seeking technical assistance.

Technical analysis reveals significant malicious indicators. VirusTotal reports 17 out of 95 security vendors flagged the domain as malicious. It is specifically flagged by vendors including Criminal IP, alphaMountain.ai, BitDefender, CyRadar, and ESET. The domain is listed on two blocklists. The infrastructure is hosted on IP address 162.55.90.94, located in Germany and belonging to AS24940 Hetzner Online GmbH. The domain was created on February 21, 2026, and uses an SSL certificate type R12.

The domain is currently down or offline, which limits its immediate threat. However, its risk score of 83 out of 100, combined with the high detection rate and recent creation date, indicates a high-risk profile. The site is likely prepared for activation or has been used in a limited campaign.