ytrxk3[.]noqucij[.]lol

The domain ytrxk3.noqucij.lol was registered with NameCheap, Inc. on February 25, 2026 and is currently listed as offline. Technical analysis shows it resolves to the IP address 192.64.119.254, which is hosted by AS22612 (Namecheap, Inc.) in the United States. The site presented a page titled "Staking" and was classified as a crypto scam, indicating an attempt to lure victims into fraudulent staking activities. No SSL certificate was observed, meaning the site operated without HTTPS encryption, a common characteristic of low‑trust malicious pages.

DNS resolution used the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. VirusTotal scanned the domain and recorded ten detections out of ninety‑five security vendors, confirming a consensus of malicious behavior. Google Safe Browsing flagged the site for social engineering, reinforcing the phishing assessment. The domain appears on three external security blocklists and has been specifically blocked by PhishDestroy, MetaMask, and SEAL, suggesting that both generic phishing filters and cryptocurrency‑focused defenses have recognized the threat.

Given the offline status, the infrastructure may be dormant, but the hosting IP and registrar remain active and could be reused for future campaigns. Defensive actions should include adding the domain and its resolving IP to firewall deny lists, monitoring for re‑registration, and ensuring endpoint security products retain the existing blocklist entries. Continuous observation of NameCheap‑hosted assets is advised, as the provider is frequently leveraged for rapid deployment of malicious domains.