ethxk[.]com

Analysis of the domain ethxk.com indicates it was actively involved in a high-risk crypto scam impersonating Ethereum, as documented in threat intelligence records dated July 24, 2026. The domain resolved to IP address 172.67.148.25, hosted on Cloudflare's infrastructure (AS13335) in the United States. No SSL certificate was present, increasing the risk of unencrypted data interception. The domain was registered on October 25, 2025, through eName Technology Co., Ltd., with nameservers rajeev.ns.cloudflare.com and saanvi.ns.cloudflare.com. The page title 'ETH 2.0' directly references Ethereum's upgrade, aligning with the reported scam type targeting cryptocurrency users.

Security vendors flagged this domain as malicious, with 14 out of 95 detection engines on VirusTotal identifying it as harmful. Google Safe Browsing classified it under 'social engineering,' and it appeared on at least one security blocklist, including PhishDestroy, which subsequently blocked access. The domain is currently offline, though its prior infrastructure remains documented in threat feeds. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

Defenders should treat this domain as confirmed phishing infrastructure. While the exact content of the site was not analyzed, the combination of a cryptocurrency-themed page title, absence of SSL, and multiple vendor detections provides sufficient evidence for blocking or monitoring. Network security teams are advised to review logs for connections to 172.67.148.25 or ethxk.com and correlate with known Ethereum-related phishing campaigns. Registrar and hosting provider details may assist in further takedown or attribution efforts.