alaf[.]cash

alaf.cash is an active domain registered on February 21 2026 through NiceNIC International Group Co., Limited. The zone is served by Cloudflare nameservers joan.ns.cloudflare.com and robert.ns.cloudflare.com and resolves to IP 104.21.11.219, which belongs to AS13335 Cloudflare, Inc., located in the United States. HTTP requests return status 200 and the site presents a page titled “Alfacash – Buy, Sell & Exchange Bitcoin, Litecoin, Ethereum, XRP, EOS, Tether and many other digital assets and blockchain tokens.” The page title and the declared brand target of Ethereum indicate a crypto‑exchange façade used for a high‑risk crypto scam. Infrastructure analysis shows the application stack includes Node.js, Vue.js, Nuxt.js, Express, and Cloudflare‑provided services such as Browser Insights, Google Tag Manager and Google Analytics. The TLS certificate is issued by Google Trust Services under the WE1 authority, confirming use of Cloudflare’s SSL termination. Open‑source intelligence records the domain in a single AlienVault OTX pulse and it appears on one external blocklist. PhishDestroy has already blocked the host, and VirusTotal scans show six of ninety‑three security vendors flagging the domain as malicious. The Gridinsoft trust score is 0/100, reinforcing the malicious assessment. No additional evidence about the site’s content or credential‑ harvesting mechanisms has been released. Given the confirmed brand impersonation of Ethereum, the high risk rating, and the presence of multiple detections, defenders should deny network traffic to 104.21.11.219, add alaf.cash to DNS and URL filtering policies, and monitor for related IOCs. Users should be warned that any unsolicited offers to buy, sell or exchange the listed cryptocurrencies originating from this domain are fraudulent.