muxdex[.]com

Analysis of muxdex.com, created on 28 July 2025 and registered through NiceNIC International Group Co., Limited, shows active malicious infrastructure targeting the Ethereum brand. The site resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. HTTP responses return a 520 status code, and the service is fronted by Cloudflare with HTTP/3 enabled. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate authority but not the legitimacy of the content.

The page title advertised as “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Muxdex” aligns with a social‑media phishing campaign that claims to facilitate cryptocurrency transactions, directly impersonating Ethereum. Threat intelligence feeds corroborate the activity: AlienVault OTX lists the domain in three separate pulses, and PhishDestroy has added it to its blocklist. VirusTotal scans report seven detections out of ninety‑five scanners, and Gridinsoft assigns a trust score of zero, indicating a high confidence of malicious intent. The domain appears on one additional security blocklist, reinforcing the assessment.

While the exact phishing landing page has not been captured, the combination of brand impersonation, a reputable SSL certificate, and Cloudflare’s CDN suggests the operators are leveraging trusted infrastructure to evade naïve detection. Defenders should block DNS resolution for muxdex.com at the network perimeter, add the IP 188.114.97.3 to deny lists, and ensure endpoint security solutions incorporate the latest threat feeds that flag this domain. Continuous monitoring of Cloudflare‑hosted assets for similar brand‑impersonation patterns is recommended, and any credential capture attempts referencing Ethereum should be treated as compromised.