mainnet-infura[.]xyz

The domain mainnet-infura.xyz is identified as a high-risk phishing site specifically designed to impersonate cryptocurrency infrastructure under the guise of a 'Pump Game.' This domain does not appear to mimic a single well-known brand but instead leverages generic terms associated with blockchain networks, likely to deceive users into engaging with fraudulent investment schemes or credential harvesting. Analysis indicates the site was operational as a cryptocurrency-themed scam, a common tactic in pump-and-dump schemes or fake token offerings targeting inexperienced investors seeking quick profits. Infrastructure analysis reveals that mainnet-infura.xyz was flagged by 17 of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. The domain was registered through NiceNIC International Group Co., Limited on September 26, 2025, and resolved to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). Despite Cloudflare's legitimate use for content delivery, threat actors frequently exploit its services to mask origin servers and evade detection. The domain appears on at least one security blocklist, and Google Safe Browsing explicitly flags it as phishing. Notably, the site operated without an SSL certificate, a red flag for users accustomed to encrypted connections in financial or cryptocurrency-related services. As of the latest assessment, mainnet-infura.xyz has been taken offline, reducing immediate exposure to new victims. However, the domain's infrastructure may remain dormant or be repurposed for future campaigns. Organizations and individuals are advised to block the domain and its associated IP address (188.114.96.3) at the network level. Users who interacted with the site should assume credential compromise and revoke access to any connected cryptocurrency wallets or accounts. Security teams should monitor for similar domains combining 'mainnet,' 'infura,' or other blockchain-related terms, particularly those registered through NiceNIC or leveraging Cloudflare hosting. Proactive DNS monitoring and retrospective log analysis are recommended to identify prior engagements with this threat.