mainnetverse[.]com

mainnetverse.com was registered on May 13 2025 through the registrar Sav.com, LLC. The domain resolves to the IPv4 address 107.172.61.186, which is assigned to AS36352 operated by HostPapa in the United States. The server presents a Let’s Encrypt R13 certificate and advertises LiteSpeed web server with HTTP/3 support. The only observed page title is “Document”, and no additional content has been publicly captured. VirusTotal records show that 2 of 95 scanned security vendors flagged the domain, indicating a low but non‑zero detection ratio.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sink‑hole service. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. As of the report date, the site is listed as taken offline, which limits real‑time verification of any phishing payloads that may have been hosted. Defenders should continue to monitor the associated IP address 107.172.61.186 for any resurgence of malicious activity, enforce outbound filtering to prevent connections to this host, and add the domain to internal blocklists.

Because the page content has not been captured, threat actors may have used the domain as a short‑lived drop‑site for credential‑harvesting pages, a common pattern for generic phishing campaigns. Correlation with other indicators of compromise (e.g., similar certificate usage or host‑provider footprints) is recommended to identify possible campaign reuse. Until further evidence emerges, the prudent stance is to treat traffic to mainnetverse.com as malicious and block it at the network perimeter.