snap-aloxi-600[.]org

Analysis of snap-aloxi-600.org, created on March 11, 2026, indicates a high‑risk brand‑impersonation campaign targeting Ethereum users. The site presented the page title "Snap Aloxi 600 | Investimento automatizado com IA para investidores modernos," suggesting a false investment offering. Infrastructure inspection shows the domain resolves to IP address 104.21.57.49, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate is identified as type E8, providing only minimal cryptographic assurance.

Reputation metrics are extremely poor: Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on three external blocklists. Google Safe Browsing flags the domain for social engineering, and AlienVault OTX lists it in one threat‑intel pulse. VirusTotal reports that five of ninety‑four scanning engines flagged the domain, reinforcing the suspicion of malicious activity. Defensive platforms have already taken action; PhishDestroy, MetaMask, and SEAL have blocked the domain, and the current operational status is offline, indicating the site has been taken down or is no longer serving content.

While the exact malicious payload or credential‑harvesting mechanisms have not been publicly disclosed, the convergence of brand impersonation, low trust scores, and multiple independent detections points to a coordinated crypto‑scam operation. Organizations should continue to enforce blocklists that include this domain, monitor for any resurgence of related indicators, and educate users about unsolicited investment offers that reference Ethereum. Defensive teams are advised to correlate any internal logs referencing the IP 104.21.57.49 or the domain name with this intelligence to identify potential exposure and to apply remediation steps, such as network filtering and user awareness campaigns.