4xexchange[.]com

4xexchange.com is a phishing domain that impersonates the GMX brand, posing a brand impersonation threat. The site was taken offline and posed a risk of credential theft or fraud by mimicking GMX's login interface. It is not safe and should be avoided.

Technical indicators for 4xexchange.com include 1 of 95 VirusTotal vendors flagging it as malicious, with SOCRadar among the detections. The domain was registered through Web Commerce Communications Limited on July 25, 2025, and resolves to IP address 172.67.159.7, located in the US and hosted by AS13335 Cloudflare, Inc. It appears on 1 security blocklist (PhishDestroy) and is found in 1 threat intelligence pulse on AlienVault OTX. The SSL certificate was issued by Google Trust Services / WE1, and the page title was 'Nur einen Moment…'. Technologies detected include Cloudflare and HTTP/3, with nameservers cody.ns.cloudflare.com and gigi.ns.cloudflare.com. Google Safe Browsing did not flag the domain.

For safety, since 4xexchange.com is a brand impersonation phishing site, users who may have interacted with it should change any passwords entered on the fake page and enable two-factor authentication on their GMX accounts. Monitor accounts for unauthorized activity and report the domain to GMX's security team or relevant authorities. As no drainer kit was detected, no token revocation is needed. To report, file a complaint with the registrar or use services like PhishDestroy.