# mchain-airdrop.xyz — MALICIOUS

> Caution: The domain mchain-airdrop.xyz is a crypto drainer actively targeting users. Avoid interaction to protect your assets and data.

## Summary
PhishDestroy has identified mchain-airdrop.xyz as a malicious domain specializing in crypto draining scams. Classified as a medium-risk threat, this domain aims to deceive users with promises related to cryptocurrency airdrops and value layers for zero-knowledge (ZK) technology.

The domain was registered on February 21, 2026, and currently resolves to IP address 104.21.3.118. It has been flagged by five separate security blocklists and shows detection by 5 out of 95 security vendors on VirusTotal, indicating ongoing malicious activity. The page title, "The Value Layer for ZK," attempts to lend credibility by referencing blockchain technology jargon. This infrastructure suggests a sophisticated attempt to lure users into providing sensitive wallet credentials or private keys.

At present, mchain-airdrop.xyz remains active and continues to pose a threat. PhishDestroy advises immediate blocking of this domain across security systems to reduce exposure. Users should refrain from visiting or interacting with the site. Monitoring tools should be updated to include this domain to mitigate potential crypto asset losses associated with its drainer functionality.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 530)
- Scam type: Airdrop Scam
- Page title: The Value Layer for ZK

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- IP: 104.21.3.118
- SSL Issuer: WE1

## Detection Status
- VirusTotal: 5 vendors flagged
  Vendors: ["alphaMountain.ai", "CyRadar", "Forcepoint ThreatSeeker", "Fortinet", "G-Data"]
- Google Safe Browsing: clean
- Blocklists: 5 hits
  Lists: ["PhishDestroy", "ScamSniffer", "Polkadot", "Enkrypt", "Codeesura"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/01992a1d-895d-7621-8f1d-f773f250871d.png
- PhishDestroy: https://phishdestroy.io/domain/mchain-airdrop.xyz/
- LLM endpoint: https://phishdestroy.io/domain/mchain-airdrop.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/mchain-airdrop.xyz/
Last updated: 2026-03-19