quinoxabit[.]com

Quinoxabit.com was observed hosting a cryptocurrency‑related scam that masquerades as the Ethereum brand. The site was registered on 21 February 2026 through Web Commerce Communications Limited and is served from the Cloudflare network (ASN 13335) with the public address 104.21.38.175 located in the United States. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection but offering no assurance of legitimacy. The page title returned by HTTP requests reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Exchange”, which aligns with the listed scam type “Crypto Scam”.

VirusTotal recorded a single positive detection out of 93 scanning engines, and the domain appears on one external blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as offline. Nameserver records point to gail.ns.cloudflare.com and langston.ns.cloudflare.com, consistent with the Cloudflare hosting. The evidence confirms that the infrastructure was deliberately designed to lure victims seeking cryptocurrency services by exploiting the Ethereum brand name.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms because no page content beyond the title has been disclosed. Defenders should add 104.21.38.175 and quinoxabit.com to local blocklists, monitor for further domains registered by the same registrar or using the same Cloudflare nameservers, and enforce URL filtering for the observed page title pattern. Continued observation of the single VirusTotal detection and any future re‑registration attempts is advised.