fxsdz[.]com

Analysis of fxsdz.com indicates a high‑risk brand‑impersonation campaign targeting Instagram users. The domain, registered through Tucows Domains Inc. on October 27, 2025, resolves to IP address 217.114.42.101, which belongs to AS57724 operated by DDOS‑GUARD LTD in Russia. Both authoritative name servers, ns1.ddos-guard.net and ns2.ddos-guard.net, are hosted by the same provider, suggesting the infrastructure is deliberately shielded behind a DDoS‑mitigation service. No SSL certificate is presented, meaning the site does not support HTTPS, which reduces transport‑layer trust and may be used to avoid certificate‑based detection.

The only visible page title, "Phantom: The crypto wallet for everyone," points to a crypto‑wallet narrative, while the declared scam type is a Crypto Scam, yet the brand target is listed as Instagram, indicating a hybrid impersonation that mixes cryptocurrency lure with Instagram branding. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 13 of 95 security vendors have flagged the site, reinforcing the malicious intent. The domain has been blocked by PhishDestroy and appears on one additional security blocklist, confirming active mitigation by threat‑intelligence feeds.

Because the site is currently taken offline, HTTP response details, content screenshots, and exact phishing payloads remain unavailable, limiting deeper content analysis. Defenders should immediately add fxsdz.com and its resolving IP 217.114.42.101 to network‑level blocklists, monitor for new domains registered with the same registrar and name‑server pattern, and update email‑filtering rules to detect Instagram‑related social‑engineering cues. Continuous observation of DDOS‑GUARD‑hosted infrastructure is recommended, as threat actors frequently reuse these assets for parallel campaigns.