mdxpro[.]xyz

PhishDestroy identifies mdxpro.xyz as an active credential theft domain impersonating the MDX Pro trading platform. No drainer kit artifacts appear linked to this domain, but live phishing content pushes users to submit exchange API keys or wallet recovery phrases directly through a fake login portal. Early reports suggest fraudulent campaign emails claiming to offer ‘exclusive trading signals’ or ‘account upgrades’ to lure victims into entering credentials. The site architecture mirrors legitimate exchange login pages, increasing the risk of account takeover and financial loss.

Technical indicators confirm this domain is a fresh threat. Registered through Spaceship, Inc. on April 21, 2026, mdxpro.xyz resolves to IP 188.114.97.3 under a Let's Encrypt SSL certificate. As of the most recent scan, VirusTotal shows 0 detections out of 95 scanners, indicating low detection coverage despite active abuse. Public blocklist monitoring shows 0 entries at the time of analysis, and Google Safe Browsing has not yet flagged the domain. The combination of a recent creation date, absence from blocklists, and use of a free CA certificate suggests this campaign is in an early, evasive stage.

This domain remains active with high-risk potential. While current detections are low, the credential theft mechanism is functional and aligned with known attack patterns targeting cryptocurrency traders. PhishDestroy recommends immediate network-level and endpoint blocking of 188.114.97.3 and domain mdxpro.xyz. Users should verify URLs via official sources and avoid entering credentials. Monitor accounts for unauthorized access and consider enabling hardware authentication. Remaining risk is assessed as HIGH due to active status, delayed detection, and potential for rapid spread.