mtdsox[.]com

This domain, mtdsox.com, is identified as a high-risk brand impersonation threat specifically targeting Binance users through a fraudulent defi mining scheme. The site mimics legitimate cryptocurrency platforms to deceive visitors into disclosing sensitive credentials or transferring assets to attacker-controlled wallets. Analysis indicates the domain was designed to exploit trust in Binance’s branding, likely distributing crypto drainer malware or facilitating unauthorized transactions under the guise of mining rewards or investment opportunities. The page title, 'defi mining,' further supports the conclusion that this was an attempt to lure users with promises of high-yield returns, a common tactic in cryptocurrency-related fraud. Infrastructure analysis reveals the domain was registered on November 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 43.174.14.42, hosted in Singapore under AS139341 (ACE). Security vendors on VirusTotal flagged the domain as malicious, with 17 out of 95 engines detecting it. The domain appears on four distinct security blocklists, and its SSL certificate, issued by Let’s Encrypt (R12), does not mitigate the risk, as threat actors commonly use valid certificates to appear legitimate. Additional indicators include its current offline status and prior blocking by multiple security frameworks, confirming its malicious intent. Users who visited mtdsox.com should immediately revoke any wallet permissions granted to the site and disconnect any connected applications. If credentials or private keys were entered, affected accounts must be considered compromised, and funds should be transferred to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Given the domain’s association with crypto drainer activity, victims should also scan their devices for malware using updated security tools. Organizations should update internal blocklists to prevent future access and alert users to the threat.