mult1xchange[.]ink

The domain mult1xchange.ink has been identified as a credential theft site. The domain does not specifically impersonate a known brand but is designed to trick users into revealing sensitive information, such as login credentials. The site's page title, 'MULTIXCHANGE — ЮСДТ Конвертация,' suggests a poorly encoded or obfuscated attempt to mimic a legitimate financial service.

Infrastructure analysis reveals that the domain was created on May 13, 2026, and is registered through NameCheap, Inc. The site resolves to the IP address 188.114.96.3. On VirusTotal, 4 out of 95 security vendors flag this domain as malicious. The domain is also listed on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, which is a common practice among phishing sites to gain user trust.

The domain remains active, posing a significant risk to users who may be tricked into entering their credentials. Immediate actions recommended include blocking the domain at the network level, educating users about the risks of phishing, and monitoring for any unauthorized access attempts. Despite being flagged by a minority of security vendors, the domain's high risk level and active status require vigilant monitoring and proactive defense measures.