# mnretrv.info — SUSPICIOUS

> mnretrv.info is a verified crypto-drainer template that appeared April 28, 2025, flagged by only 1 of 95 scanners.

## Summary
PhishDestroy identifies mnretrv.info as an active cryptocurrency-draining phishing site that masquerades as a legitimate login or wallet portal to trick visitors into surrendering seed phrases or private keys.  

This domain was flagged by only one of the 95 VirusTotal security vendors on the day it was created, April 28, 2025. The registrant used NameCheap, Inc. and obtained an SSL certificate from Google Trust Services to lend false credibility to the page. The hosting IP is 188.114.96.3, a known bulletproof segment often repurposed for short-lived scam campaigns.  

If you visited mnretrv.info, disconnect your device from the internet immediately, run a full antivirus scan, and inspect any browser extensions for suspicious permissions. Do not enter wallet passwords or seed phrases on the site. Report the incident to your wallet provider and to PhishDestroy for takedown support. Treat any further emails or links connected to mnretrv.info as unsafe until independently verified.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-04-28 10:23:50
- Registrar: NameCheap, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/mnretrv.info
- PhishDestroy: https://phishdestroy.io/domain/mnretrv.info/
- LLM endpoint: https://phishdestroy.io/domain/mnretrv.info/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/mnretrv.info/
Last updated: 2026-04-02