get-mnsth[.]com

PhishDestroy identifies get-mnsth.com as an ACTIVE crypto drainer phishing domain currently under investigation for malicious intent. This domain is flagged for attempting to deceive users into connecting cryptocurrency wallets under false pretenses, posing a severe risk to digital asset security. The threat is classified as a 'generic_phishing' attack with crypto-focused malicious payloads, not just credential theft or generic impersonation. Users should avoid interacting with this domain completely to prevent unauthorized wallet access or fund exfiltration. This domain, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP 104.21.69.234 and was created on March 28, 2026. Despite being only days old, get-mnsth.com already operates with a Let’s Encrypt SSL certificate, potentially misused to appear legitimate. PhishDestroy found this domain flagged by 3 of 95 VirusTotal vendors at initial discovery, indicating it is not yet widely recognized on public threat feeds. This low detection rate, combined with the domain’s recent creation and the use of a reputable SSL provider, increases the risk of successful deception in credential or wallet drainer attacks. The combination of new domain registration, low VT detection, and active status creates a time-sensitive threat that requires immediate caution. Given the active status, the low VirusTotal detection rate, and the specific threat of crypto drainer functionality, PhishDestroy assesses get-mnsth.com as HIGH RISK. Users should immediately block access via hosts file or firewall rules and avoid visiting the site. If any interaction has already occurred—such as wallet connection or credential entry—disconnect immediately, revoke permissions, and transfer funds to a secure wallet. Consider using hardware wallets or air-gapped devices for high-value assets. Monitor transaction logs for unauthorized activity. Always verify domains via official channels before entering cryptographic or financial data.