bigxpro[.]com

This domain, bigxpro.com, was observed hosting a cryptocurrency-related impersonation campaign targeting the Ethereum brand. The site’s HTML title resolves to “BitAlx”, which does not correspond to the legitimate Ethereum ecosystem and suggests a deceptive rebranding effort. Registration data indicates the domain was created on 30 April 2025 via Dynadot Inc., a registrar commonly used for both legitimate and malicious registrations. The infrastructure points to a single IPv6 address 2606:4700:3030::ac43:a1c4 that belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate presented by the site is identified as “WE1”, a generic certificate often associated with short-lived phishing deployments. Threat intelligence feeds have flagged the domain as a crypto scam.

One of ninety-three VirusTotal scanners raised an alert, and the domain appears on one external blocklist. Gridinsoft assigned a trust score of 40 out of 100, indicating a low confidence rating. PhishDestroy has already blocked the domain, and the current operational status is offline, suggesting the site has been taken down or is no longer serving content. While the available evidence confirms the domain’s use for Ethereum brand impersonation, many details remain unknown. No public malware samples, post-exploitation payloads, or command-and-control infrastructure have been disclosed.

The specific phishing kit or template employed cannot be identified from the present data, and the presence of any additional hosting or fallback servers has not been observed. Defenders should continue to monitor the IPv6 address and associated Cloudflare ASN for any re-appearance of malicious activity. Adding the domain to internal blocklists and updating DNS filtering policies to deny resolutions to the identified address will mitigate accidental user exposure.