mmm[.]rtzihfb[.]cn

This domain, mmm.rtzihfb.cn, poses a high-risk credential theft threat by impersonating the OE cryptocurrency exchange platform. The site mimics the official OE trading application, presenting itself as the legitimate source for downloads, registration, and access to the exchange’s services. Users who interact with the site risk exposing sensitive login credentials, personal information, or financial data to unauthorized third parties. The site’s design and branding are engineered to deceive visitors into believing they are engaging with a trusted platform, increasing the likelihood of successful exploitation. Analysis indicates the domain was registered on November 11, 2024, through 厦门易名科技股份有限公司, a registrar commonly associated with high-risk domains. The site resolves to the IP address 156.226.74.234, located in Hong Kong under AS135097 (LUOGELANG (FRANCE) LIMITED), an autonomous system with a history of hosting malicious infrastructure. At the time of assessment, the domain appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal. Notably, the site lacks an SSL certificate, a critical red flag for any platform handling user credentials or financial transactions. Users who have visited mmm.rtzihfb.cn or entered credentials on the site should take immediate action to mitigate potential harm. First, cease all interaction with the domain and avoid downloading any files or applications linked from it. If credentials were submitted, change passwords for the affected account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Monitor financial and cryptocurrency accounts for unauthorized transactions, and consider reporting the incident to relevant cybersecurity authorities or the legitimate OE exchange for further guidance.