xrydexy[.]com

The domain xrydexy.com was registered on May 18 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the Cloudflare edge address 104.21.60.223, which is geolocated to Canada. The authoritative nameservers alina.ns.cloudflare.com and marty.ns.cloudflare.com indicate that the site is served entirely behind Cloudflare’s CDN and DDoS mitigation services. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E8) and returns HTTP 200 responses for the landing page. The page title advertises “Xrydexy | Fast Crypto Trading with a Modern UX”, a phrasing commonly used in fraudulent cryptocurrency trading lures. VirusTotal scans have flagged the domain by 3 of 95 security vendors, and AlienVault OTX lists it in a single threat‑intelligence pulse. The domain appears on one public blocklist and is already blocked by the PhishDestroy feed, while Gridinsoft assigns it a trust score of 0 out of 100. Combined evidence points to a high‑risk, active phishing operation targeting users interested in cryptocurrency services. The low vendor detection count suggests the site is newly deployed, consistent with the May 2026 creation date, and may rely on a lightweight phishing kit that evades many scanners. No additional infrastructure such as command‑and‑control servers or payload hashes has been publicly disclosed, leaving the exact credential‑harvesting mechanism uncertain. Defenders should add xrydexy.com to network‑level deny lists and configure web‑proxy filters to block HTTP and HTTPS requests to the domain. Continuous monitoring of DNS queries for the associated Cloudflare IPs and the two nameservers can provide early warning of related campaigns. Incident response teams should treat any credential submissions to this site as compromised and advise affected users to rotate passwords and revoke any cryptocurrency API keys. Ongoing threat‑intel feeds should be consulted for updates on additional indicators that may emerge.