virwox[.]io

virwox.io was observed hosting a counterfeit cryptocurrency exchange page that advertises buying and selling of Bitcoin and Ethereum. The page title retrieved from the site reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Virwox,” and the domain explicitly impersonates the Ethereum brand. Registration data shows the domain was created on 18 October 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers are ethan.ns.cloudflare.com and jule.ns.cloudflare.com, and the domain resolves to the IPv6 address 2606:4700:3030::ac43:c081, which belongs to Cloudflare, Inc. (AS13335) located in the United States. An SSL certificate issued by Google Trust Services (WE1) is present, indicating the transport layer is encrypted with a legitimate certificate.

Despite the valid certificate, reputation services assign a Gridinsoft trust score of 0 / 100, reflecting extreme distrust. HTTP requests receive a 403 response, and the site is currently listed as offline. Malware and URL reputation scanners have flagged the domain: six of ninety‑five VirusTotal security vendors reported malicious activity, and the domain appears on one security blocklist. AlienVault OTX includes the domain in three separate threat pulses. PhishDestroy has also added the domain to its blocklist.

The risk level is classified as elevated. At present, the exact payload or phishing kit deployed on the site has not been publicly disclosed, and no concrete samples have been shared. Defenders should block DNS resolution for virwox.io and its associated IPv6 address, monitor for any resurgence of the domain, and add the domain to internal threat intelligence feeds. Given the combination of brand impersonation, low trust score, multiple vendor detections, and inclusion in threat‑intel collections, organizations handling Ethereum‑related credentials or transactions should treat any communications referencing virwox.io as malicious.