kxfx[.]com

Analysis of kxfx.com shows an active high‑risk brand‑impersonation campaign targeting the DeFi aggregator 1inch. The domain resolves to 16.162.65.178, an Amazon Web Services host located in Hong Kong and advertised under ASN 16509. DNS is served by GoDaddy’s default name servers ns65.domaincontrol.com and ns66.domaincontrol.com, and the registration date of March 16 1996 indicates a long‑standing domain that has been repurposed for malicious use. The site delivers an HTTP 301 redirect and presents a page titled "比特幣交易所-比特幣交易平臺|比特幣價格港幣," which references a Bitcoin exchange in Chinese, consistent with the reported crypto‑scam classification. Technical fingerprints reveal a Windows Server environment running Microsoft ASP.NET on IIS, a stack often leveraged for automated phishing kits. The TLS certificate is issued by Let’s Encrypt (R13), offering no validation beyond domain control. Independent threat feeds have flagged the domain: PhishDestroy lists it as blocked, one security blocklist includes it, and Gridinsoft assigns a trust score of 0 / 100. VirusTotal scans show 12 of 95 security vendors flagging the host, reinforcing the suspicion. While the exact page content has not been examined, the combination of brand impersonation, cryptocurrency‑related page title, and low trust metrics suggests a likely credential‑ harvesting or fund‑extraction operation. Defenders should add kxfx.com to blocklists, monitor outbound traffic for connections to 16.162.65.178, and enforce strict URL filtering for any 1inch‑related login flows. Further investigation of the redirected page and any associated payloads is recommended to confirm the attack vector and to update detection signatures.