ethxf[.]com

Analysis of ethxf.com indicates the domain was registered on 25 October 2025 through eName Technology Co.,Ltd. and points to the Cloudflare edge address 104.21.32.81, which is announced as AS13335 Cloudflare, Inc. and geolocated to the United States. The domain resolves without an SSL certificate, suggesting it was served over plain HTTP at the time of observation. The public page title returned by the host was "ETH 2.0", matching the declared brand target of Ethereum and the listed scam type of a crypto‑related scam. Google Safe Browsing has flagged the domain for social engineering, and the site appears on a known security blocklist and is actively blocked by PhishDestroy. VirusTotal reports that 13 of 95 scanned scanners identified the domain as malicious, reinforcing the suspicion of abuse.

The domain’s Gridinsoft trust score is 0 / 100, indicating a lack of confidence from that heuristic engine. Nameserver records point to rajeev.ns.cloudflare.com and saanvi.ns.cloudflare.com, both Cloudflare‑managed, which is consistent with the observed IP address. The domain is currently offline, and no further content has been captured. The available evidence confirms that ethxf.com was used to impersonate the Ethereum brand, likely to lure victims into a cryptocurrency‑related fraud.

No additional technical artefacts such as malware payloads, phishing forms, or redirect chains have been disclosed, leaving the exact attack vector uncertain. Defenders should continue to block any resolution of ethxf.com at network perimeter devices, update URL filtering and threat intelligence feeds with the domain and its associated IP address, and monitor for any resurgence of the domain or its aliases. Because the hosting is on Cloudflare, any future re‑registration could reuse the same edge IP range, so ongoing watch‑listing of the IP 104.21.32.81 is advisable. Organizations that handle Ethereum transactions should educate users about unsolicited links referencing "ETH 2.