advjx[.]net

advjx.net is an active high‑risk domain observed delivering a brand‑impersonation campaign that mimics legitimate investment services. The site first appeared in open‑source intelligence on August 3 2025 and has since been referenced in a single AlienVault OTX pulse. Its risk rating is high, and it is currently listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL.

Technical infrastructure shows the domain resolves to the Cloudflare‑owned address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. Authoritative nameservers are ezra.ns.cloudflare.com and tessa.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint. The web server returns HTTP 200 and advertises HSTS, HTTP/3, and Cloudflare Browser Insights, while the front‑end is built with Vue.js.

The landing page title reads “Growtrivo: One‑Stop Global Investment Platform | Forex | Commodities | Stocks | …”, clearly positioning the site as an investment platform and matching the declared impersonation of an investment scam. The page content, combined with the presence of financial‑related keywords, suggests the operators aim to lure victims into fraudulent trading or cryptocurrency schemes. VirusTotal scans have flagged the domain on 7 of 95 security engines, and Gridinsoft assigns a trust score of 29 / 100, reinforcing the malicious assessment.

Defenders should add advjx.net to network‑level deny lists and ensure DNS filtering solutions block both the domain and its Cloudflare IP range. Continuous monitoring of the associated IP and certificate changes is advised, as the infrastructure may be repurposed. Incident response teams should treat any communications originating from this domain as malicious, and users should be warned not to provide personal or financial information.