fraxdesktop[.]com

Analysis of the domain fraxdesktop.com indicates a high-risk brand impersonation campaign targeting Frax, a known digital asset platform. The domain was registered on May 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 104.21.58.194, which is associated with Cloudflare infrastructure. The page title, 'Frax Desktop — The Future of Digital Money on Your Desktop,' explicitly references Frax, reinforcing the likelihood of brand impersonation. Security vendors have flagged this domain on multiple blocklists: PhishDestroy and BLP-Malware have blocked it, and it appears on two additional security blocklists. Gridinsoft assigns a trust score of 0/100, further indicating malicious intent. AlienVault OTX records the domain in 17 threat intelligence pulses, suggesting active tracking by security researchers. Six of the 95 security vendors on VirusTotal detect the domain as malicious. Technical indicators reveal the use of Cloudflare services, including HTTP/3 and HSTS, which may be leveraged to obscure hosting details and enhance perceived legitimacy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. As of July 12, 2026, the domain remains active, and no takedown efforts have been observed. Defenders should treat this domain as a confirmed phishing resource targeting Frax users. Network-level blocking of 104.21.58.194 and the domain itself is recommended. Security teams should monitor for any attempts to distribute or access this domain within their environments, particularly in contexts involving cryptocurrency transactions or wallet downloads. Further analysis of the site's content and payloads is required to determine the exact attack vectors, but the available indicators confirm its malicious classification.