aicryptofxtrading[.]sbs

Analysis indicates that the domain aicryptofxtrading.sbs was registered on 25 October 2025 through the HOSTINGER operations, UAB registrar. The authoritative nameservers are dee.ns.cloudflare.com and trevor.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to the IPv4 address 104.21.21.220, a Cloudflare edge node that is commonly leveraged for fast content delivery and for obscuring the true hosting location of malicious infrastructure. The domain appears on a single public blocklist; PhishDestroy has listed it as a phishing source and the entry remains active as of the report date.

VirusTotal has processed the domain with 91 distinct scanning engines, none of which returned a positive detection at the time of analysis. While the absence of detections does not imply benign intent, it confirms that the domain has not yet been fingerprinted by the majority of commercial scanners. The limited public intelligence suggests a nascent phishing campaign, likely targeting users interested in cryptocurrency trading, given the domain’s lexical composition. No additional data such as Safe Browsing verdicts, Open Threat Exchange reports, SSL certificate details, HTTP response codes, or page title metadata are currently available, leaving the content and exact phishing vector unverified.

Consequently, the primary observable indicators are the registration metadata, Cloudflare DNS configuration, the resolved IP address, and the blocklist entry. Defenders should proactively block the domain and its associated IP address at perimeter defenses, update intrusion‑detection signatures to include the observed nameserver pair, and monitor for any future emergence of URL or payload samples linked to aicryptofxtrading.sbs. Continuous re‑scanning on services like VirusTotal and inclusion in internal reputation feeds are recommended to capture any subsequent changes in detection status.