mrbigcoin[.]com

PhishDestroy identifies mrbigcoin.com as a live cryptocurrency scam infrastructure under active investigation, posing a high-immediate risk to users engaging with coin offers or wallet prompts. This domain was flagged for generic phishing lures centered on fraudulent “big coin” investment schemes, with threat actors likely aiming to harvest credentials or cryptocurrency deposits under the guise of premium returns. The site’s rapid deployment—registered only days ago on July 22, 2025—combined with its IP residence (104.21.33.101) on Cloudflare’s edge and a superficially legitimate Google Trust Services SSL certificate, creates a deceptive but brittle attack surface vulnerable to takedown if reported swiftly. This domain was registered through NameSilo, LLC, leveraging the registrar’s anonymized privacy protection to obscure operator identity. VirusTotal currently shows zero detections across 95 engines, indicating the infrastructure remains under the radar for signature-based defenses, while no public blocklists have yet flagged the hostname or its hosting IP. The SSL certificate issued by Google Trust Services adds cosmetic legitimacy, tricking cautious users into overlooking red flags like the recently minted domain age and lack of any discernible corporate footprint. Persistent monitoring shows the domain resolves consistently to the same IP and remains active, suggesting a live campaign rather than a brief fly-by operation. To neutralize exposure, users and organizations should block both the domain and IP at DNS/firewall layers and avoid all links or QR codes associated with mrbigcoin.com. If credentials or payment details were provided, rotate passwords immediately, revoke API keys tied to exposed accounts, and report the incident to relevant cryptocurrency platforms and law enforcement via platform abuse channels. Continuous monitoring is advised as the campaign may pivot domains or IPs to evade detection.