crypto-ax[.]com

crypto-ax.com was registered through Tucows Domains Inc. on 9 September 2024. The domain resolves to Cloudflare edge address 104.21.96.1, associated with AS13335 in the United States. DNS resolution is served by the authoritative nameservers fonzie.ns.cloudflare.com and tessa.ns.cloudflare.com. No TLS certificate is presented, indicating the site is served over plain HTTP, which is consistent with the lack of an HTTPS indicator in the observed metadata. The site title returned from the HTTP response is “crypto-hold.com – Invest and exchange cryptocurrency,” a clear mismatch that suggests the domain is being used to host content unrelated to its own name.

The page claims to facilitate cryptocurrency investment and exchange, while the underlying intent is identified as a social‑media phishing campaign that impersonates the Ethereum brand. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence that the domain is malicious. On public threat feeds the domain appears on a single security blocklist and is listed by the PhishDestroy service as taken offline. VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain, reinforcing the malicious classification despite the limited coverage. The low detection count may be a result of the short observation window rather than an indication of benign behavior.

Given the infrastructure, the lack of SSL, and the brand‑impersonation motive, defenders should block DNS resolution for crypto-ax.com at the network perimeter and add the IP address 104.21.96.1 to any cloud‑based web filtering rules that support Cloudflare edge IPs. Endpoint security solutions should be updated with the indicator set, and security operations teams should monitor for any resurgence of the domain or similar pattern of mismatched page titles using the same Cloudflare nameservers.