dexnodechain[.]world[.]mainnetchain[.]world

Analysis of the domain dexnodechain.world.mainnetchain.world indicates that it was registered on 21 February 2026 and subsequently resolved to the IP address 206.217.128.211, which belongs to the HostPapa network (AS36352) located in the United States. The server presented an SSL certificate identified as “R10”, but no further certificate metadata were disclosed. The site’s HTML title is “Multiverse Deep Sync – One wallet, multiverse support”, suggesting an attempt to lure cryptocurrency users. Threat intelligence flags the domain as a brand‑impersonation campaign targeting the Metamask wallet, and the associated scam type is recorded as a crypto scam. Multiple defensive feeds have already taken action against the domain.

It is listed on the blocklists maintained by PhishDestroy and ScamSniffer, and the same domain appears on two independent security blocklists. VirusTotal analysis shows that seven out of ninety‑three scanning engines reported malicious behavior, reinforcing the suspicion of a fraudulent operation. Independent scoring from Gridinsoft assigns a trust score of zero out of one hundred, indicating a complete lack of confidence in the site’s legitimacy. The current HTTP status is marked as offline, which suggests that the phishing infrastructure has been taken down or otherwise rendered inaccessible. However, the presence of the domain in historical blocklists means that remnants of the campaign may still be referenced by security tools that cache prior detections.

No additional evidence such as observed payloads, credential‑stealing forms, or redirection chains was disclosed in the available intelligence. Defenders should continue to block the IP address 206.217.128.211 and enforce domain‑level deny rules for dexnodechain.world.mainnetchain.world across web‑gateway and DNS filtering solutions.