semexbit[.]org

semexbit.org was observed as a brand‑impersonation site targeting the “base” brand. The domain was registered through Dynadot Inc on 21 February 2026 and resolved to the Cloudflare IP address 104.21.80.1, which is advertised as being located in the United States under ASN 13335. The site presented the page title “SemexBit” and was classified as a crypto‑scam in the intelligence feed. SSL analysis shows the certificate identifier “WE1”, but no further validation details are available.

Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a completely untrusted status. VirusTotal reports that 10 of 95 scanned security vendors flagged the domain, confirming malicious behavior. The domain is listed on a single public blocklist and has been actively blocked by the PhishDestroy service. Current operational status is offline, suggesting the site has been taken down or is otherwise inaccessible.

The available data points provide sufficient confidence to label the infrastructure as malicious, but the exact payload or victim interaction flow remains undocumented. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP 104.21.80.1 for any resurgence of malicious activity, and add the domain to internal threat‑intel feeds. Ongoing observation of Cloudflare‑hosted assets linked to this ASN is recommended, as attackers frequently rotate sub‑domains under the same infrastructure. No additional evidence such as HTTP response codes, content snapshots, or sandbox analysis is presently available, so further investigation should focus on traffic logs and any residual artifacts that reference semexbit.org.