# kosdexpax.com — SUSPICIOUS

> Avoid kosdexpax.com – a low-risk phishing site pretending to sell cryptocurrency. The domain is offline; do not share personal info.

## Summary
PhishDestroy labels kosdexpax.com as a low-risk generic phishing threat primarily targeting cryptocurrency buyers. The domain masquerades as a cryptocurrency exchange platform to deceive users.

Although only one out of 95 security vendors flagged it, and it appears on a single security blocklist, kosdexpax.com resolved to IP 188.114.96.3 and was registered recently in March 2026 via NiceNIC International Group Co., Limited. These factors suggest a nascent but suspicious setup.

The site is currently offline, mitigating immediate risk. Users should avoid interacting with this domain or submitting any credentials. Continuous monitoring is recommended to detect any potential reactivation or new phishing infrastructure linked to this domain.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: Cryptocurrency Exchange | Buy cryptocurrency on kosdexpax

## Domain Intelligence
- Registered: 2026-03-06 15:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 188.114.96.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: shubhi.ns.cloudflare.com zahir.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["Fortinet"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://i.ibb.co/Tqxv2Jx9/a7b75f789a49.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/kosdexpax.com
- Wayback Machine: https://web.archive.org/web/https://kosdexpax.com
- PhishDestroy: https://phishdestroy.io/domain/kosdexpax.com/
- LLM endpoint: https://phishdestroy.io/domain/kosdexpax.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/kosdexpax.com/
Last updated: 2026-03-19