apextradxi[.]com[.]basesafex[.]com

Analysis of the domain apextradxi.com.basesafex.com indicates a brand-impersonation campaign targeting Coinbase users, classified as a crypto scam. The domain was registered on December 24, 2025, through Spaceship, Inc., and resolved to the IP address 92.204.41.13, hosted under AS29066 (velia.net Internetdienste GmbH) in France. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The page title, 'Apextradxi Multi-Chain Claim Platform,' suggests an attempt to lure victims with promises of cryptocurrency rewards or claims, a common tactic in crypto-related phishing schemes.

Infrastructure analysis reveals the domain was using nameservers dns1.afeeshost.ltd, dns2.afeeshost.ltd, and dns3.afeeshost.com, which may indicate a pattern of disposable or rapidly rotated hosting infrastructure. As of July 25, 2026, the domain appears offline, though its prior activity was flagged by 11 of 93 security vendors on VirusTotal and blocked by PhishDestroy. Only one security blocklist has recorded this domain, suggesting limited visibility or recent takedown efforts. Defenders should note that while the domain is currently inactive, the registration details, hosting provider, and nameserver patterns align with known phishing infrastructure.

Organizations are advised to monitor for similar domains registered through Spaceship, Inc., or resolving to the same IP range. Given the absence of SSL and the domain's association with a crypto scam, users should be cautioned against interacting with any future iterations of this campaign. The exact content and functionality of the phishing page remain unanalyzed, but the available evidence confirms its malicious intent.