satrixmarket[.]live

The domain satrixmarket.live was observed online and later taken offline, triggering an elevated risk rating for brand impersonation of Ethereum. Registration data shows the domain was created through OwnRegistrar, Inc., and is served from the IP address 192.3.190.186, which belongs to AS36352 (HostPapa) located in the United States. DNS resolution used the authoritative servers dns1.webproserver.com and dns2.webproserver.com. An SSL certificate issued to PhishDestroy / botadmin.destroy.tools was presented, indicating the use of a known phishing‑related certificate authority.

The site’s page title, "Satrix Market - Home," was captured, but no further page content has been publicly disclosed. Infrastructure analysis identified a stack comprising Node.js, Bootstrap, Vue.js, Nuxt.js, LiteSpeed, Smartsupp, jQuery, and HTTP/3, suggesting a modern web application framework possibly leveraged to host the fraudulent content. Malware and reputation scanners on VirusTotal recorded four positive detections out of ninety‑five security vendors, and the domain appears on a single security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification.

The domain was also blocked by the PhishDestroy sinkhole, confirming its involvement in phishing‑related operations. While the exact phishing payload or credential‑capture mechanism has not been released, the combination of brand impersonation, hostile SSL issuance, low trust rating, and multiple vendor detections provides sufficient evidence for defenders to treat the domain as hostile. Security teams should continue to block the domain at perimeter filters, monitor for any re‑registration attempts, and update threat intelligence feeds with the observed indicators of compromise. Incident response personnel should also watch for related activity targeting Ethereum users that may leverage similar infrastructure or certificate patterns.