zexar[.]io

Analysis of zexar.io shows a newly registered domain (creation date February 21 2026) that presents a page titled “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | ZEXAR”. The title and the declared scam type “Crypto Scam” indicate an attempt to impersonate the Ethereum brand and lure victims into a fraudulent cryptocurrency exchange. Infrastructure analysis reveals the domain resolves to IP 188.114.97.3, which is part of AS13335 owned by Cloudflare, Inc., and is geolocated in the United States. The site was observed using an SSL certificate identified as WE1, suggesting a possibly self‑signed or low‑trust certificate.

Reputation services rate the domain extremely poorly: Scamadviser assigns a trust score of 1 out of 100, Gridinsoft reports 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and it is currently taken offline. VirusTotal scanning shows that four of ninety‑three security vendors flagged the domain as malicious, providing independent confirmation of suspicious activity. The elevated risk rating is consistent with the combination of brand impersonation, low reputation scores, and vendor detections.

At present, no additional technical details such as phishing kit signatures, payload drops, or victim reports are available, leaving the exact attack flow uncertain. Defenders should immediately add zexar.io to URL filtering and DNS block lists, monitor outbound connections to its hosting IP, and enforce TLS inspection to detect any future re‑hosting attempts. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the domain’s status or detection profile.