get-paxos[.]net

The domain get-paxos.net is a confirmed phishing site engaged in brand impersonation targeting Ethereum users. It presents itself as a legitimate cryptocurrency investment platform, specifically mimicking Pax Gold, to deceive victims into disclosing sensitive information or transferring funds. This scam operates as a cryptocurrency phishing scheme without an associated drainer kit. As of the latest verification, get-paxos.net has been taken offline.

Technical indicators confirm the malicious nature of get-paxos.net. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and Gridinsoft, which assigned it a trust score of 0/100. It appears on 1 security blocklist, specifically PhishDestroy, though Google Safe Browsing has not flagged it. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on September 20, 2025, the domain resolves to the IP address 172.67.159.92, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate is issued by WE1, and the observed page title was 'Pax Gold - The safest way to own investment-grade gold'.

Individuals who interacted with get-paxos.net should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. Monitor accounts for unauthorized transactions and enable two-factor authentication on all cryptocurrency-related platforms. Report the phishing domain to the impersonated brand, Ethereum, and submit it to platforms like PhishTank or the Anti-Phishing Working Group to aid in broader takedown efforts.