get-paxos[.]com

Analysis dated July 24, 2026 flags get-paxos.com as a high-risk brand-impersonation conduit. The domain was registered on September 7 2025 through NiceNIC International Group Co., Limited and is serviced by Cloudflare nameservers gerald.ns.cloudflare.com and hera.ns.cloudflare.com. DNS resolution points to IP 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., and geolocated to the United States. No TLS certificate is presented, meaning all HTTP traffic would be unencrypted.

The HTTP response is unavailable because the site is currently taken offline, and the HTTP status code cannot be confirmed. The page title observed before takedown reads "Pax Gold – The safest way to own investment‑grade gold," indicating a possible attempt to lure users with a financial‑themed narrative. The domain is explicitly listed as impersonating the Ethereum brand and is categorized as a "Fake Airdrop" scam, suggesting it may have advertised non‑existent token distributions to extract credentials or funds. Reputation scoring from Gridinsoft rates the host at 0 / 100, and the domain appears on a single security blocklist.

VirusTotal scans show 2 of 95 AV engines flagging the domain, and PhishDestroy has added it to its blocklist. Given the combination of brand impersonation, lack of encryption, low trust score, and detection by multiple vendors, defenders should immediately block DNS resolution to 188.114.96.3, enforce URL filtering for get-paxos.com, and monitor related Cloudflare‑hosted IP ranges for new aliases. Continuous re‑scanning is advised in case the site reappears, and any inbound traffic claiming airdrop offers tied to Ethereum should be treated as malicious.