zachxbt[.]info

This domain, zachxbt.info, is flagged as a generic phishing site targeting users of the legitimate crypto investigation brand ZachXBT. Analysis indicates the site impersonates the real ZachXBT (@zachxbt) profile, likely to harvest login credentials, wallet details, or distribute malicious payloads under the guise of investigative services. No drainer kit signatures were identified in initial scans, but the page title explicitly mimics the brand’s identity, suggesting a focus on social engineering rather than automated token theft. Infrastructure analysis reveals the domain resolves to IP 104.21.1.178 and was registered through Cloudflare, Inc., a common registrar for threat actors due to its privacy protections. The domain lacks an SSL certificate, increasing the risk of man-in-the-middle attacks or data interception. VirusTotal reports 3/95 security vendors flagging the domain as malicious, while it appears on one security blocklist. No Google Safe Browsing (GSB) detections were recorded at the time of assessment, though this may reflect delayed reporting rather than absence of risk. The domain is currently offline, likely due to takedown actions or voluntary suspension by the registrar. However, residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations should monitor for credential reuse or wallet transactions linked to this domain. Network defenders are advised to block the IP 104.21.1.178 and implement DNS-based filtering for zachxbt.info to prevent future access attempts. Users should verify the legitimacy of crypto-related sites via official channels before entering sensitive information.