eqonex[.]io

The domain eqonex.io is currently taken offline but exhibits multiple indicators consistent with a crypto‑related impersonation campaign targeting the Ethereum brand. Infrastructure analysis shows the domain resolves to the IP address 172.67.215.127, which belongs to Cloudflare, Inc. (AS13335) and is geographically associated with the United States. The domain is hosted on Cloudflare’s network and uses the nameservers duke.ns.cloudflare.com and meilani.ns.cloudflare.com, confirming the hosting relationship. Registration data indicates the domain was created on March 03, 2026 and was registered through NiceNIC International Group Co., Limited; no SSL certificate is present, suggesting the site was served over plain HTTP before being taken down.

Reputation signals are strongly negative: the Gridinsoft trust score is 0 out of 100, and the domain appears on a single known security blocklist. It has been flagged by PhishDestroy as a malicious entry, and six of ninety‑four security vendors on VirusTotal have reported it as suspicious, reinforcing the assessment of a crypto scam. The page title observed during earlier crawls – "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | EQONEX" – directly references Ethereum, confirming the impersonation intent.

While the exact content of the site is not available for review, the combination of brand‑specific title, crypto‑scam classification, and hostile reputation metrics provide sufficient evidence to classify eqonex.io as a high‑risk impersonation vector. Defenders should ensure the domain is blocked at perimeter and DNS filtering layers, monitor for any re‑activation attempts, and update threat‑intel feeds with the observed indicators. Continuous observation of the associated IP range and Cloudflare‑served domains is recommended to detect potential repurposing of the same infrastructure for future campaigns.