musk2xe[.]cc

This domain is flagged as a cryptocurrency phishing site targeting users through impersonation of high-profile individuals or entities. Analysis indicates the infrastructure is designed to deceive victims into disclosing wallet credentials or transferring digital assets under false pretenses. The domain currently holds an 'under investigation' risk level due to its recent registration and limited detection history, but available evidence suggests malicious intent. Infrastructure analysis reveals the domain was registered on October 30, 2024, through Above.com Pty Ltd. and resolves to IP address 76.223.26.96. It employs Google Cloud infrastructure, Nginx web server, and Google Cloud CDN, alongside a Let's Encrypt SSL certificate for encrypted communications. Despite zero detections out of 95 engines on VirusTotal, the domain appears on one security blocklist and has been assigned a trust score of 0/100. The page title, matching the domain name (musk2xe.cc), further suggests a lack of legitimate branding or content. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP address across network security controls. Organizations should monitor for outbound connections to 76.223.26.96 and inspect SSL certificates issued by Let's Encrypt for similar domains. End-users should be educated on recognizing cryptocurrency phishing tactics, particularly those leveraging impersonation of public figures. Given the domain's recent creation and low detection rate, proactive hunting for related infrastructure (e.g., domains registered through the same registrar or hosted on adjacent IPs) is recommended to identify potential campaign expansion.