zedxpress[.]com[.]zentlegacyexchange[.]com

Analysis indicates that the domain zedxpress.com.zentlegacyexchange.com was registered on 21 February 2026 through Web Commerce Communications Limited operating as WebNic.cc. The authoritative name servers ns100.webnic.cc and ns101.webnic.cc resolve the domain to the IPv4 address 172.245.14.131, which belongs to AS36352 (HostPapa) and is geolocated in the United States. The site presents an SSL certificate labeled R11, but no further certificate details are available. VirusTotal records show a single positive detection out of 93 participating scanners, confirming that at least one security vendor has flagged the domain as malicious. In addition, the domain appears on one external blocklist and has been listed by the PhishDestroy service.

Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of confidence in the site’s legitimacy. The page title returned from the live endpoint is "Zedxpress", and the intelligence categorizes the activity as a crypto‑scam that impersonates the brand "across". The current operational status is offline, suggesting that the site has been taken down or is otherwise inaccessible at the time of reporting. Defenders should consider the domain malicious and add it to network and email filtering rules.

Because the hosting provider is HostPapa, threat‑intelligence feeds that monitor AS36352 may be useful for identifying related infrastructure. Continuous monitoring of the associated IP address and name‑server records is advised in case the domain is re‑registered or the IP is reused for new campaigns. The single VirusTotal detection, low trust score, and presence on a phishing blocklist collectively warrant an elevated risk rating. Until further forensic evidence is available, the recommendation is to block traffic to the domain and to watch for any related indicators that reference the same registrar, name servers, or IP range.