zxfh[.]cc

Analysis of the domain zxfh.cc, created on September 29, 2025 and registered through Dominet (HK) Limited, shows an active crypto‑scam infrastructure that impersonates the brand Across. The site returns HTTP 200 without an SSL certificate and presents the page title “Download Base – Your home for everything onchain,” suggesting a malicious attempt to lure cryptocurrency users. DNS resolution points to IP 104.18.35.15, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States.

The domain is served by four nameservers – ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainname – a configuration commonly observed in fast‑flux or disposable hosting setups. Reputation checks indicate the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. VirusTotal scans flagged the domain by five of ninety‑three security vendors, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification.

While the exact phishing page content has not been publicly disclosed, the combination of brand impersonation, a crypto‑focused title, and low trust metrics confirms a high‑risk profile. Defenders should block DNS resolution to 104.18.35.15, add zxfh.cc to web‑filter and intrusion‑prevention rules, monitor outbound traffic for connections to Cloudflare‑hosted IPs associated with this domain, and treat any user‑initiated requests to the site as compromised. Ongoing observation is advised to detect any pivot or credential‑harvesting activity that may emerge from this infrastructure.