rexfordcryptoretrievals[.]com

Analysis as of July 24 2026 indicates that rexfordcryptoretrievals.com is an inactive site that was previously used to impersonate Facebook for the purpose of wallet or seed phishing. The site presented the page title “Home - Rexford Crypto Retrievals” and leveraged a WordPress stack with MySQL, PHP, Nginx and front‑end libraries including particles.js, Swiper and Slick, as well as Yoast SEO. The SSL certificate was issued by Let’s Encrypt (R12) and the domain was registered through NameSilo, LLC on 25 October 2025. Hosting resolved to IP 37.157.255.217, located in Germany and belonging to AS24961 (WIIT AG).

Nameservers ns1.bingloft.com and ns2.bingloft.com were observed. The infrastructure received a Gridinsoft trust score of 1 out of 100, indicating extremely low reputation. Detection data show that 4 of 95 VirusTotal scanners flagged the domain, and the domain appears on one blocklist and one AlienVault OTX pulse. PhishDestroy has already blocked the domain.

Although the site is currently offline, the combination of a low trust score, active blocklist entries, and the presence of a Let’s Encrypt certificate issued for a short‑lived domain suggests a deliberate phishing operation aimed at harvesting cryptocurrency wallets or recovery seeds. Defenders should continue to monitor the associated IP address and nameservers for any re‑activation, add the domain and its IP to web filtering and intrusion‑prevention rules, and share the indicator set with threat‑intel partners. Further analysis is required to confirm the exact content of the landing page and any credential‑capture mechanisms, but the existing evidence is sufficient to classify the domain as a high‑confidence Facebook impersonation used for wallet/seed phishing.