mextretery[.]com

This domain, mextretery.com, is flagged as an active crypto drainer site designed to impersonate the Onchain protocol. Analysis indicates the site employs a fraudulent interface mimicking legitimate blockchain services to deceive users into connecting cryptocurrency wallets, subsequently draining funds through malicious smart contract interactions. The page title 'Onchain' and the use of cryptocurrency-specific terminology further corroborate the targeted nature of this threat, which aligns with known crypto drainer kits observed in recent campaigns. Infrastructure analysis reveals the domain was registered on March 15, 2026, through GMO Internet, Inc., and currently resolves to the IP address 172.67.207.247, hosted on AS13335 (Cloudflare, Inc.). Detection metrics show 9 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on three additional security blocklists. The SSL certificate is issued by Let's Encrypt (serial number E7), a common tactic to lend superficial legitimacy to phishing infrastructure. Despite these indicators, the domain remains operational and unblocked by some major security providers. Current status confirms the domain is still active, posing an ongoing risk to users who may encounter it through malicious advertisements, compromised social media accounts, or search engine poisoning. Response actions by security entities such as PhishDestroy, MetaMask, and SEAL have mitigated exposure, but the domain's persistence underscores the need for heightened vigilance. Users are advised to verify domain authenticity through official sources, employ hardware wallets for transactions, and monitor wallet permissions for unauthorized access. The high-risk designation remains justified due to the domain's active exploitation of cryptocurrency users and its evasion of broader detection mechanisms.