mohimen[.]com

The domain mohimen.com has been confirmed as a high-risk crypto credential theft site designed to harvest wallet login credentials and private keys. Analysis indicates the infrastructure was actively targeting cryptocurrency users through deceptive interfaces mimicking legitimate wallet services. The domain is currently offline, though prior activity suggests it may have been part of a broader campaign to drain digital assets from compromised accounts. Infrastructure analysis reveals mohimen.com was registered on October 27, 2024, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with malicious domains. The site resolved to the IP address 104.234.134.77 and employed a Let's Encrypt SSL certificate to present a false sense of legitimacy. Detection metrics show the domain was flagged by 13 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. Additionally, the domain appeared on three distinct security blocklists, including MetaMask and PhishDestroy, further corroborating its malicious classification. Technologies detected on the site included WordPress, MySQL, PHP, jQuery Migrate, jQuery, and HTTP/3, which are commonly exploited in phishing operations to facilitate credential exfiltration. Current status indicates mohimen.com has been taken offline, though the underlying infrastructure may remain dormant for future reuse. Organizations and individuals are advised to block the domain and associated IP address (104.234.134.77) at the network level. Cryptocurrency users should verify wallet interfaces against official sources and enable multi-factor authentication where available. Security teams are recommended to monitor for indicators of compromise, including the domain's creation date, registrar details, and SSL certificate issuance patterns, as these may reappear in related campaigns. Proactive threat hunting for similar WordPress-based credential theft sites is strongly encouraged.