bitofxinvestments[.]com

bitofxinvestments.com is an active malicious site that presents itself as a premium cryptocurrency investment company. The domain was registered on 2026-02-21 through Sav.com, LLC and resolves to the IPv4 address 173.0.59.2, which belongs to AS27323 (Wowrack.com) located in the United States. The site serves content over HTTPS using a Let’s Encrypt R12 certificate, indicating the operators have configured TLS but does not imply legitimacy. Infrastructure analysis shows the domain is hosted on a LiteSpeed server, uses Bootstrap, jQuery, Slick, Smartsupp, GetButton and HTTP/3, all of which are common in low‑cost hosting environments. The nameservers ns1.korrectserver.com and ns2.korrectserver.com are publicly listed, and the MX record points to the same domain, a pattern often seen in phishing infrastructure. Reputation data assigns a Gridinsoft trust score of 0/100 and the domain is currently listed on one security blocklist. It has been flagged by PhishDestroy and appears in a single AlienVault OTX pulse. VirusTotal analysis shows 6 of 93 security vendors flagged the domain, supporting the malicious classification. No additional intelligence on payloads or credential‑stealing mechanisms is available at this time. Defenders should block network connections to 173.0.59.2 and add bitofxinvestments.com to URL filtering and email gateway blocklists. Monitoring of DNS queries for the domain and its associated nameservers is recommended to detect internal access attempts. Because the site mimics a crypto investment offering, any email or web traffic referencing “premium crypto currency investment” from this domain should be treated as suspicious and discarded. Continuous re‑evaluation is advised as additional indicators may emerge.