mxi-finance[.]com

PhishDestroy identifies mxi-finance.com as an active credential theft domain impersonating a financial services brand. The domain was registered on April 13, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 188.114.96.3. VirusTotal analysis shows 1/95 security vendors flagging the domain, with a Let's Encrypt SSL certificate in use. Technical indicators confirm elevated risk: the domain has a VirusTotal detection ratio of 1/95, is hosted on 188.114.96.3, and was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED on April 13, 2026. No Google Safe Browsing (GSB) blocklist status is available, but the low VT score suggests minimal initial detection. The domain’s recent creation and low vendor flagging indicate a likely emerging threat with potential for rapid expansion. The campaign is currently active, with no known takedown actions at this time. Users should block mxi-finance.com at the network and DNS levels, avoid interaction, and report the domain to threat intelligence platforms. Remaining risk is elevated due to the domain’s active status, SSL encryption, and financial brand impersonation. Immediate action is required to mitigate credential theft exposure.