cordexchange[.]xyz

Analysis indicates that the domain cordexchange.xyz was created on 18 June 2025 and is currently taken offline. During its active period it resolved to the IP address 198.251.89.220, which belongs to AS53667 FranTech Solutions and is geolocated in the United States. The domain was registered via Porkbun LLC and did not present an SSL/TLS certificate, leaving the HTTP service unencrypted. An HTTP request returned a 200 status code and the page title “Cord Exchange | Cryptocurrency trading and invest platform”, which aligns with the listed scam type of brand impersonation and the declared target brand “ethereum”.

The lack of HTTPS, combined with a Gridinsoft trust score of 0 out of 100, underscores the low credibility of the site. Threat intelligence shows that only a single security blocklist currently lists the domain, and PhishDestroy has actively blocked it. VirusTotal analysis recorded one positive detection out of 95 scanning engines, providing additional confirmation that at least one vendor identified malicious behavior.

The combined evidence—recent registration, US‑based hosting, absence of TLS, low trust rating, positive vendor detection, and alignment of the page title with the claimed cryptocurrency trading premise—supports an elevated risk assessment for brand impersonation. Defenders should continue to deny traffic to this host, add the domain and its IP address to internal blocklists, and monitor related ASN traffic for potential re‑use. Because the site is offline, further content inspection is not possible, and the current data set represents the complete observable footprint.