9jaz8qlmy5[.]quantix9-modul[.]it

Analysis indicates that the domain 9jaz8qlmy5.quantix9-modul.it is actively engaged in brand impersonation targeting American Express (Amex), as of July 25, 2026. The domain was registered on February 21, 2026, through Dynadot LLC and remains operational, returning an HTTP 200 status. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers oaklyn.ns.cloudflare.com and pablo.ns.cloudflare.com, resolving to IP 172.67.171.132 in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious infrastructure leveraging Cloudflare's services.

The page title, 'Quantix 9.0 Modul | Massimizza la tua Rendita Crypto con IA,' suggests a cryptocurrency-themed scam, though the exact content and mechanics of the phishing kit are not yet analyzed. Detection data shows the domain is flagged by one of 93 security vendors on VirusTotal, though this does not constitute conclusive evidence of malicious activity. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specifically target phishing and fraudulent domains. Gridinsoft assigns a trust score of 0/100, further indicating high-risk classification.

Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where American Express credentials or cryptocurrency-related transactions are processed. The use of Cloudflare nameservers and hosting is consistent with threat actors attempting to obfuscate origin infrastructure, though no direct attribution to a specific threat group is available. Monitoring for related domains registered through Dynadot LLC or resolving to the same IP may reveal additional infrastructure linked to this campaign. No evidence of takedown or sinkholing is present as of the report date.