payxworld[.]com

payxworld.com was registered on 21 February 2026 and currently resolves to the IPv4 address 94.141.122.181, which is allocated to NEON CORE NETWORK LLC in Finland (ASN 205775). The domain is served through Cloudflare and presents a web stack consisting of Nginx front‑end, Node.js application runtime on Ubuntu, and client‑side libraries including Vue.js, Nuxt.js, Chart.js and jsDelivr. DNS is hosted on GoDaddy’s nameservers ns15.domaincontrol.com and ns16.domaincontrol.com. The site’s SSL certificate is identified as "R11", indicating a publicly trusted certificate, but the certificate details have not been disclosed.

The page title returned by the server reads "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | PayX", matching the declared scam type of a fake cryptocurrency exchange that impersonates the Ethereum brand. Reputation checks show the domain appears on one security blocklist and has been flagged by Google Safe Browsing for social‑engineering content. VirusTotal records indicate a single positive detection out of 93 scanning engines, reinforcing the suspicion of malicious intent. PhishDestroy has also added the domain to its block list.

The site is presently taken offline, which limits real‑time observation, and no further content has been captured. Given the convergence of brand impersonation, the use of a reputable SSL certificate, and the presence of a legitimate‑looking technology stack, the domain is likely to have been used to lure victims seeking cryptocurrency services. Defenders should continue to block the domain at DNS and proxy layers, monitor the hosting IP for any resurgence, and update threat‑intel feeds with the observed indicators. Additional verification of the SSL certificate chain and any residual HTTP responses would help to confirm the scope of the campaign, but the current evidence already justifies a high‑confidence classification as a fake exchange targeting Ethereum users.