rtojan[.]com

This domain is flagged as an elevated-risk phishing site specifically targeting cryptocurrency users through fraudulent exchange services. Analysis indicates the domain mimics legitimate onchain trading platforms to deceive victims into disclosing wallet credentials, private keys, or transferring funds to attacker-controlled addresses. The threat type is classified as cryptocurrency phishing, with a focus on memecoin and crypto trading impersonation. Infrastructure analysis reveals the domain rtojan.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. It resolves to IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services, which may lend false legitimacy to unsuspecting users. The domain appears on one security blocklist and is flagged by 7 out of 95 security vendors on VirusTotal, including detections for phishing and fraud. AlienVault OTX records the domain in one threat intelligence pulse, while Gridinsoft assigns a trust score of 0/100. The page title, "Trojan | Fastest Onchain Exchange for Memecoin & Crypto Trading," further confirms the intent to impersonate a legitimate trading platform. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (188.114.96.3) at the network perimeter. Organizations and individuals should verify the legitimacy of cryptocurrency platforms by cross-referencing official domains and checking for valid SSL certificates issued to the correct entity. Users should enable multi-factor authentication on all crypto wallets and exchanges, and avoid entering sensitive information on sites flagged by security vendors. In cases of suspected compromise, revoke access to connected wallets, monitor for unauthorized transactions, and report the domain to relevant financial and cybersecurity authorities for takedown.