fxaxam[.]com

Analysis of fxaxam.com shows a newly registered domain created on March 02, 2026 that is currently taken offline but was previously used for a crypto‑focused investment scam. The page title “Fxax: One‑Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil” aligns with the listed scam type of Crypto Scam, indicating an attempt to lure victims with promises of diversified financial products. The domain is registered through GMO Internet, Inc. and resolves to the Cloudflare‑provided address 172.67.210.234, belonging to ASN 13335, a Cloudflare network located in the United States. No SSL certificate is present, yet the site enforced HSTS, and the underlying technology stack includes Vue.js, HTTP/3, and Cloudflare Browser Insights.

Trust scoring from Gridinsoft returned 0 / 100, reflecting an extremely low reputation. Security‑vendor scanning on VirusTotal recorded 2 detections out of 94 scanners, and the domain appears on three independent blocklists, with explicit blocks from PhishDestroy, MetaMask, and SEAL. The nameservers cass.ns.cloudflare.com and clay.ns.cloudflare.com confirm reliance on Cloudflare DNS. While the site is offline, its prior activity and the low trust score suggest it was likely used to harvest credentials or crypto payments.

Defenders should add fxaxam.com to network‑level blocklists, enforce DNS sinkholing for the domain, and monitor outbound connections to the associated Cloudflare IP. Correlate logs for any attempts to resolve or contact the domain, especially from browsers or wallets that may have been targeted by the MetaMask block. Updating intrusion‑prevention signatures with the observed page title and the specific technology fingerprint (Vue.js with HSTS) can improve detection of similar future deployments. Continuous watch of the registrar GMO Internet, Inc. for new registrations with comparable naming patterns is also advised.