outgrwtrd[.]com[.]mxitftd[.]com

This domain, outgrwtrd.com.mxitftd.com, is identified as a credential theft operation specifically targeting cryptocurrency traders. Analysis indicates the site impersonates legitimate brokerage platforms, presenting itself as 'Outgrowthtrade - Crypto trading with a reliable broker' to deceive users into entering sensitive account credentials, wallet keys, or personal identification details. The infrastructure is designed to harvest login data, which can be exploited for unauthorized access to digital assets or further social engineering attacks. The threat extends beyond immediate financial loss, as compromised credentials may be reused across multiple platforms, amplifying the risk of cascading breaches. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on May 28, 2025, through GMO Internet, Inc., and currently resolves to the IP address 213.165.249.109. Security vendors on VirusTotal flagged the domain, with 6 out of 95 engines detecting malicious activity. Additionally, the domain appears on one security blocklist, and its Gridinsoft trust score is 0 out of 100, indicating a complete lack of credibility. Detected technologies include DataLife Engine, PHP, Apache HTTP Server, and Smartsupp, which are often leveraged in phishing campaigns to enhance site functionality and evade detection. The combination of these factors confirms the domain's role in a coordinated credential theft scheme. Users who visited outgrwtrd.com.mxitftd.com should take immediate action to mitigate potential risks. First, revoke access to any cryptocurrency wallets or exchange accounts that may have been linked to the site. Enable multi-factor authentication on all financial and email accounts to prevent unauthorized access. Monitor account activity for suspicious transactions or login attempts, and report any anomalies to the respective platform's security team. If credentials were entered, reset passwords immediately using a unique, complex passphrase. Additionally, scan local devices for malware, as phishing sites may deploy additional payloads to maintain persistence. Finally, report the domain to relevant cybersecurity organizations to aid in broader threat mitigation efforts.