apextrxnifty[.]org

This domain, apextrxnifty.org, was observed targeting the Revolut brand through a crypto‑focused impersonation campaign. The site was registered on 26 August 2025 via HOSTINGER operations, UAB, and is served from the IP address 46.202.182.249, which belongs to AS47583 Hostinger International Limited located in the United States. No TLS certificate was presented, indicating the site operated without HTTPS protection. The authoritative nameservers are ns1.dns‑parking.com and ns2.dns‑parking.com, both typical of parked domains rather than dedicated hosting. The page title returned from the live endpoint reads “TronDAO | Reserving The Future of TRON Holders”, suggesting the content was positioned as a cryptocurrency offering, consistent with the listed scam type “Crypto Scam”. Although the brand target is Revolut, the page title does not reference Revolut, implying that the impersonation may rely on social engineering rather than visual cloning.

Threat intelligence signals are strong. The domain appears on four security blocklists and has been blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX includes the domain in one pulse, and VirusTotal reports nine of ninety‑five scanning engines flagging it as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Current connectivity checks show the domain is taken offline, preventing direct analysis of the payload.

Consequently, the exact phishing page layout, credential capture mechanisms, or malicious scripts remain unverified. However, the combination of registrar information, hosting under a known bulk‑hosting provider, absence of TLS, low trust score, and multiple blocklist entries provides sufficient confidence to classify the infrastructure as hostile. Defenders should immediately block any network resolution of apextrxnifty.org at the DNS or firewall level, monitor for outbound connections to 46.202.182.249, and add the domain to internal threat feeds.