bitexco[.]xyz

The domain bitexco.xyz is currently active and classified as a high‑risk cryptocurrency brand‑impersonation campaign targeting users of the Aave platform. The site presents a page titled “Bitexco” and leverages a TLS certificate issued by Let’s Encrypt, indicating a publicly available encryption layer. Its creation date of 7 March 2026 places the infrastructure within a narrow operational window, consistent with fast‑deployment phishing operations. Network analysis shows the domain resolves to the IP address 172.67.128.240, which belongs to AS13335, a Cloudflare network located in the United States. The authoritative name servers are kay.ns.cloudflare.com and casey.ns.cloudflare.com, both owned by the same provider. Service fingerprints include Varnish, Fastly, Cloudflare Browser Insights, and HTTP/3, while the underlying content appears to be served from GitHub Pages, suggesting a hybrid hosting arrangement that exploits multiple CDN layers for resilience. VirusTotal reports four detections out of ninety‑five scanning engines, and the domain is listed on three separate security blocklists. Independent blocklist providers PhishDestroy, MetaMask, and SEAL have already flagged the site, and a Gridinsoft trust score of zero confirms a lack of reputation. The HTTP response code 200 indicates the page is reachable and delivering content to visitors, reinforcing its operational status. Defenders should enforce network‑level deny rules for bitexco.xyz and its associated IP 172.67.128.240, and incorporate the domain into endpoint and browser protection policies. Continuous monitoring of the Cloudflare name servers for new subdomains is advised, as the same infrastructure may be reused for additional campaigns. Users of Aave should be warned to verify URLs and avoid entering credentials on sites that do not reside under the official Aave domain.