myetherwallet[.]cn[.]com

Analysis of the domain myetherwallet.cn.com indicates that it is currently active and serving a crypto drainer campaign. The authoritative DNS records show four centralnic.net nameservers (ns1‑ns4.centralnic.net) and the domain was created on 21 February 2026. Registration was performed through Instra Corporation Pty Ltd. Resolving the host yields the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) located in the United States. HTTP requests receive a 301 redirect and the page title returned is “Just a moment…”. The site presents an SSL certificate issued by Google Trust Services under the WE1 profile, confirming the use of a valid TLS chain. Automated reputation services assign a Gridinsoft trust score of 0 / 100, and ten of ninety‑five VirusTotal scanners have flagged the domain as malicious. The domain is listed on three public blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL. Detected technologies include Cloudflare and HTTP/3, suggesting modern delivery infrastructure. No additional content analysis is available, and the exact phishing page structure remains unverified. Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the listed nameservers, and consider adding the IP address 188.114.96.3 to deny‑list rules. Ongoing observation is recommended to capture any changes in hosting or content.