mog-onchainheroes[.]xyz

Analysis of mog-onchainheroes.xyz shows a recent infrastructure setup consistent with a phishing operation. The domain was registered on March 06, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN13335) with the IP address 188.114.97.3 located in the United States. Both authoritative name servers, huxley.ns.cloudflare.com and macy.ns.cloudflare.com, resolve to the same Cloudflare edge, and the site does not present an SSL certificate, indicating HTTP-only delivery. The only observable content is a page title of "Just a moment..."; no further page details have been captured.

The domain has been flagged by PhishDestroy and appears on one external security blocklist, confirming that at least one industry sinkhole has taken action. VirusTotal scans report four detections out of ninety‑four vendors, providing independent corroboration of malicious intent. Current DNS resolution shows the domain taken offline, but the underlying hosting and registration details remain active, allowing rapid re‑deployment. Uncertainty remains around the specific phishing lure, target audience, and any credential‑harvesting pages that may have been served before takedown, as no payload samples or URL paths have been disclosed.

Defenders should immediately block DNS resolution to 188.114.97.3 and add mog-onchainheroes.xyz to URL filtering policies. Continuous monitoring of the domain’s DNS records is advised to detect any re‑pointing to new IPs. Given the Cloudflare hosting, consider implementing rate‑limiting or challenge‑response mechanisms for outbound connections to this IP range. Integration of the domain into threat‑intel feeds and sharing of the detection indicators with downstream security tools will help reduce exposure to any future phishing campaigns that may reuse this infrastructure.