paxosbit[.]com

Analysis of paxosbit.com, observed on July 24, 2026, indicates an elevated‑risk generic phishing infrastructure that has been taken offline. The domain was registered on March 12, 2026 through Gname.com Pte. Ltd. and resolves to the IPv4 address 107.149.129.237, which is announced by AS394432 (PEG TECH INC) and geolocated to Singapore. The authoritative name servers are a8.share-dns.com and b8.share-dns.net, both typical of shared‑hosting services. HTTP requests return a 404 status code, and the only visible page title is “Paxos”, providing no further context about the intended victim brand. The web stack enumerated by passive scanners includes PHP, the ThinkPHP framework, Bootstrap, Nginx, jQuery, and the presence of HTTP Strict Transport Security, all served over a Let’s Encrypt certificate (R13).

Reputation checks show the domain appears on a single security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the site as social engineering, and VirusTotal records six positive detections out of ninety‑five submitted scanners, reinforcing the malicious assessment. No additional intelligence such as OTX references or malware payloads has been disclosed. Because the site is currently offline, dynamic content, credential‑stealing forms, or redirect chains cannot be verified. The lack of a publicly visible landing page limits attribution of the specific phishing lure, but the combination of a generic page title and the observed technology stack suggests a template‑driven campaign that could be repurposed for multiple targets.

Defenders should continue to block paxosbit.com at perimeter and DNS layers, monitor for any resurgence of the domain or its IP address, and add the address to internal threat‑intel feeds. Network traffic to the associated IP should be logged and inspected for anomalous outbound connections.