mainnetinpinfix-deg.website

The web service is front‑ended by Nginx and includes a reference to Liveinternet, suggesting a generic hosting stack. HTTP requests to the root path return a 403 status code, and the page title reported by the scanner is “Account disabled by server administrator”. Such a response is typical of a placeholder or access‑denied page used to mask malicious activity while preserving a legitimate TLS handshake.

Reputation data classifies the domain as a high‑risk account‑takeover campaign. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records five detections out of ninety‑five scanned security vendors. The domain is listed on four public blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple independent feeds have already flagged it. The combination of a recent registration, low trust score, and multiple detections aligns with the observed “Account Takeover” scam type.

Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms hosted behind the 403 page, as no malicious payload was captured in the current scan. Defenders should treat the domain as hostile: enforce DNS‑level blocking, add the IP address 65.21.174.205 to network deny lists, and monitor TLS logs for connections to the Let's Encrypt certificate. Continuous re‑evaluation is advised in case the site transitions from a placeholder to an active credential‑stealing page.