mexmnbgjh[.]com

This domain is flagged as a high-risk cryptocurrency phishing threat specifically targeting users of Onchain-related services. Analysis indicates the site employs deceptive tactics to harvest wallet credentials, seed phrases, or private keys under the guise of legitimate blockchain interactions. The page title 'Onchain' suggests an attempt to mimic authentic decentralized platforms, increasing the likelihood of successful social engineering against cryptocurrency holders. Infrastructure analysis reveals the domain mexmnbgjh.com was registered on March 15, 2026, through GMO Internet, Inc., an uncommon registrar for such threats. It resolves to the IP address 104.21.88.204, hosted on Cloudflare's network (AS13335), a common obfuscation technique to mask origin servers. Security vendor detections on VirusTotal stand at 17 out of 95, indicating moderate consensus on malicious classification. The domain appears on three distinct security blocklists and is actively blocked by multiple cryptocurrency-focused protection mechanisms. Its SSL certificate, issued by Let's Encrypt (serial number E8), provides encrypted connections but does not validate legitimacy. The domain remains operational despite these detections, demonstrating persistence in its fraudulent operations. Mitigation against this threat requires heightened vigilance from cryptocurrency users. Individuals should verify domain authenticity by cross-referencing official project URLs and avoiding interaction with unrecognized platforms. Wallet software should be configured to reject connections from domains not explicitly whitelisted. Network-level protections, such as DNS filtering or endpoint detection systems, should be updated to include this domain and its associated IP address. Users who may have interacted with mexmnbgjh.com should immediately revoke any connected wallet permissions, transfer assets to a new secure wallet, and monitor transactions for unauthorized activity. Given the domain's active status and targeted nature, ongoing monitoring of blockchain addresses linked to this campaign is recommended.