# PhishDestroy domain threat record: cxabcx.vip

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cxabcx.vip/
Machine-readable companion: https://phishdestroy.io/domain/cxabcx.vip/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:20:41 UTC
- Last availability or vendor check: 2026-10-26 16:41:12 UTC
- Stored record updated: 2026-10-26 19:30:32 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.4.177
- Registrar in stored WHOIS data: NameMart Pte. Ltd.
- Registrar country in stored WHOIS data: SG
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-21 07:43:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17914-cad0-766f-a433-b0e8f259f12b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cxabcx.vip
- Certificate Transparency search: https://crt.sh/?q=%25.cxabcx.vip
- Web Archive lookup: https://web.archive.org/web/*/https://cxabcx.vip/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a plain white page with a small circular loading spinner centered in the frame; no navigation, form fields, buttons, offers or brand marks were visible. PhishDestroy listed cxabcx.vip through automatic intake on 2026-10-26 after a VirusTotal malicious verdict and a registration age of 5 days. PhishDestroy first saw this domain on 2026-10-26.

How the scam works
Page metadata recorded with the capture names CEX.IO as the impersonated brand, framing the domain as a fake exchange front end rather than a genuine service. In this category of scam, a loading screen like the one observed precedes a counterfeit account sign-in or sign-up surface that collects credentials or payment details from visitors who believe they are dealing with the real exchange. Because no form was visible in this capture, the credential-collection step is described as a category risk rather than an observed interaction.

Evidence
The screenshot itself shows only the spinner centered on a white background, with no credential form observed. urlscan returned a clean verdict for its capture on 2026-10-26 and an earlier clean scan on 2026-10-23, Google Safe Browsing was not flagged on 2026-10-26, and these are negative results that do not establish safety. VirusTotal flagged the domain as malicious on an analysis dated 2026-10-22, retrieved 2026-10-26, with SOCRadar labelling it phishing. External blocklists returned 0 entries and OTX recorded 0 pulses, both checked 2026-10-26, while PhishDestroy's internal blocklist flag was set. No cross-site redirect was observed, the redirect chain contained only cxabcx.vip, and 41 tracker requests were recorded on 2026-10-26.

Infrastructure
cxabcx.vip was registered on 2026-10-21 through NameMart Pte. Ltd. and resolved behind Cloudflare, with a Cloudflare WAF recorded. The notable weaknesses are that Content-Security-Policy, HSTS/strict-transport, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP headers are all absent; DNSSEC is unsigned, and no email authentication was recorded (SPF lookups 0, with DKIM and DMARC not present). CAA records are present for the domain. The TLS handshake used TLS 1.3 with cipher TLS_AES_256_GCM_SHA384, forward secrecy and ALPN h2, and a valid certificate does not make an impersonating destination trustworthy.

What to do
If you submitted credentials or account details on cxabcx.vip, change your password on your genuine CEX.IO account, enable two-factor authentication, and review recent account activity for unexpected access. Treat any message or advertisement linking to cxabcx.vip as hostile and do not re-enter information there. Defenders should block the exact domain cxabcx.vip at proxy, mail and DNS layers, retain the capture hashes for pivoting, and monitor for similarly newly registered lookalikes.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17914-cad0-766f-a433-b0e8f259f12b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/99e5939e-dae8-4bb5-bc92-53e8264446eb
URLQuery report: https://urlquery.net/report/477599d0-55e6-46c1-bc34-e854613ba3b0
Stored capture screenshot: https://i.ibb.co/TBJZr18Y/f37dcc2ec888.png
Cloudflare Radar screenshot (2026-10-26T16:29:51Z): https://screenshots.phishdestroy.io/cf/99e5939e-dae8-4bb5-bc92-53e8264446eb.png
URLScan screenshot (2026-10-22T12:38:39Z): https://screenshots.phishdestroy.io/us/01a1639e-c470-748d-a155-29660c28bf7c.png
URLScan capture report: https://urlscan.io/result/01a1639e-c470-748d-a155-29660c28bf7c/
VirusTotal report: https://www.virustotal.com/gui/domain/cxabcx.vip
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cxabcx.vip
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 18:09:31 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/TBJZr18Y/f37dcc2ec888.png
  Captured: 2026-10-26 16:41:12 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a17914-cad0-766f-a433-b0e8f259f12b.png
  Captured: 2026-10-26 16:41:12 UTC
  Source report: https://urlscan.io/result/01a17914-cad0-766f-a433-b0e8f259f12b/
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16629-e887-7623-bde1-b92d1978eb8a.png
  Captured: 2026-10-23 00:29:53 UTC
  Source report: https://urlscan.io/result/01a16629-e887-7623-bde1-b92d1978eb8a/
  SHA-256: 339e55c6d2222bd6b00f7cdaf8bc1dbc68b5cfa9b34d347e13feb8003a387060
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1639e-c470-748d-a155-29660c28bf7c.png
  Captured: 2026-10-22 12:38:39 UTC
  Source report: https://urlscan.io/result/01a1639e-c470-748d-a155-29660c28bf7c/
  SHA-256: 56150f298fa1faa9a0186502aa5a1466a28f57b47c39cb0988e73b66309ede5d
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17920-a5e0-71da-9c3c-cce0098d773d.png
  Captured: 2026-10-26 16:52:34 UTC
  Source report: https://urlscan.io/result/01a17920-a5e0-71da-9c3c-cce0098d773d/
  SHA-256: f267c7b37211fdcc0e4834317fa7c34be66a3075f602904118ce45e2394228d6
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/99e5939e-dae8-4bb5-bc92-53e8264446eb.png
  Captured: 2026-10-26 16:29:51 UTC
  Source report: https://radar.cloudflare.com/scan/99e5939e-dae8-4bb5-bc92-53e8264446eb
  SHA-256: d8ec754ce0d7e6e65742bc46e8f75edaf8962f4bd912721f9f9b732a26c809af
- URLQuery: https://screenshots.phishdestroy.io/uq/477599d0-55e6-46c1-bc34-e854613ba3b0.png
  Source report: https://urlquery.net/report/477599d0-55e6-46c1-bc34-e854613ba3b0
  SHA-256: 5d2152dee93abd2feaab2574d16e32f48c6bb1ae1c50b10fdf816d9c119be246

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T18:11:39Z",
        "uuid": "01a17914-cad0-766f-a433-b0e8f259f12b",
        "scanned_at": "2026-10-26T16:39:39Z",
        "final_url": "http://cxabcx.vip/",
        "redirects": [
            {
                "to": "https://cxabcx.vip/",
                "from": "http://cxabcx.vip/",
                "status": 307
            },
            {
                "to": "http://cxabcx.vip/",
                "from": "https://cxabcx.vip/",
                "status": 307
            },
            {
                "to": "https://cxabcx.vip/",
                "from": "http://cxabcx.vip/",
                "status": 307
            },
            {
                "to": "https://cxabcx.vip/",
                "from": "https://cxabcx.vip/"
            }
        ],
        "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 5,
        "apex_age_days": 5,
        "requests": 12,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 76,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:13Z",
        "uuid": "99e5939e-dae8-4bb5-bc92-53e8264446eb",
        "scanned_at": "2026-10-26T16:29:51Z",
        "final_url": "https://cxabcx.vip/",
        "status": 200,
        "history": [
            {
                "url": "https://cxabcx.vip/",
                "status": 200
            }
        ],
        "dom_hash": "6633ee6a311980627cf242406e0e0a1a56bd6a4d0cfb951114b4bfd4467b99d3",
        "doc_hash": "258d6e29e2ab29d1938910f0d4fdf04e2d506dd63be1cd534e255e51beac5dd8",
        "domain_risks": [
            "New Domains",
            "Security Risks",
            "Newly Seen Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cxabcx.vip",
                "type": "A",
                "value": "172.67.132.81"
            },
            {
                "name": "cxabcx.vip",
                "type": "A",
                "value": "104.21.4.177"
            },
            {
                "name": "cxabcx.vip",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:4b1"
            },
            {
                "name": "cxabcx.vip",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:8451"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.132.81",
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "created": "2026-10-21T09:43:00Z",
            "updated": "2026-10-21T09:47:00Z",
            "expires": "2027-10-21T09:43:00Z",
            "nameservers": [
                "alaric.ns.cloudflare.com",
                "brynne.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:28:03Z",
        "analysis_at": "2026-10-22T13:29:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "SOCRadar": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "NameMart Pte. Ltd.",
        "created": "2026-10-21T09:43:00Z",
        "expires": "2027-10-21T09:43:00Z",
        "updated": "2026-10-21T09:47:00Z",
        "first_seen": "2026-10-21T10:00:08Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.132.81"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "alaric.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "alaric.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "brynne.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.4.177"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:4b1"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:8451"
            }
        ],
        "dns_at": "2026-10-22T13:34:47Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.cxabcx.vip",
                "cxabcx.vip"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "639772321354690669754001281754ec3a1",
            "sha256": "5ca8051b717f0c0c74fbe38efc85200d8490731a3cda725a7814a7f714517479",
            "subject": "cxabcx.vip",
            "valid_to": "2027-01-19T08:56:00Z",
            "valid_from": "2026-10-21T08:56:01Z"
        },
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "registrar_iana_id": "4162",
            "registrar_url": "https://www.namemart.com/",
            "created": "2026-10-21T09:43:00Z",
            "updated": "2026-10-21T09:47:00Z",
            "expires": "2027-10-21T09:43:00Z",
            "status": [
                "addPeriod",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "alaric.ns.cloudflare.com",
                "brynne.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "server transfer prohibited",
                "add period"
            ],
            "events": {
                "expiration": "2027-10-21T09:43:00Z",
                "last changed": "2026-10-21T09:47:00Z",
                "registration": "2026-10-21T09:43:00Z",
                "last update of RDAP database": "2026-10-21T09:59:58Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:35:08Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "cxabcx.vip"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:31:43Z",
            "first": "2026-10-26T16:31:43Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4285
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "title": "CEX.IOPortfolio - Web Developer",
            "author": "Web Developer",
            "ogType": "website",
            "robots": "noindex, nofollow, noarchive, nosnippet",
            "ogImage": "/platform/dev/logo_144.png?2.0.1792635421941",
            "ogTitle": "Portfolio - Web Developer",
            "keywords": "Become a member of a global community More than six million crypto enthusiasts around the world have accessed our award-winning ecosystem.",
            "themeColor": "#667eea",
            "description": "Your all-in-one crypto platform to buy, sell, trade, hold and earn cryptocurrencies⑴Earn crypto flexibly with CEX.IO",
            "ogDescription": "Professional web development services"
        },
        "trackers": {
            "requests": 41
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 41,
                "wait": 127,
                "connect": 6,
                "download": 0
            },
            "response_ms": 176
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 8251,
            "co2_grams": 0.0003,
            "cleaner_than": 76
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.65",
                    "host": "brynne.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.31",
                    "host": "alaric.ns.cloudflare.com"
                }
            ],
            "zone": "cxabcx.vip"
        },
        "location": {
            "ip": "2606:4700:3033::6815:4b1",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "cxabcx.vip"
        },
        "dns": {
            "A": [
                "172.67.132.81",
                "104.21.4.177"
            ],
            "NS": [
                "alaric.ns.cloudflare.com",
                "brynne.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"alaric.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418082392, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3032::ac43:8451",
                "2606:4700:3033::6815:4b1"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3033::6815:4b1",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://cxabcx.vip"
            ]
        },
        "subdomains": {
            "count": 2,
            "subdomains": [
                "adminwanadminduoke8.cxabcx.vip",
                "www.cxabcx.vip"
            ]
        },
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "created": "2026-10-21T09:43:00Z",
            "updated": "2026-10-26T09:43:04Z",
            "expires": "2027-10-21T09:43:00Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "brynne.ns.cloudflare.com",
                "alaric.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```