safevexy[.]com

safevexy.com was registered on August 31, 2025 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare infrastructure (nameservers alfred.ns.cloudflare.com and brenda.ns.cloudflare.com, IP 172.67.162.102, AS13335, United States). The site presents a TLS certificate issued by Google Trust Services under the WE1 issuance, indicating a valid HTTPS handshake. An HTTP request returns status 403, which suggests the content is not publicly reachable at the time of analysis. The page title observed in the scan reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Safevexy”, and the domain is explicitly listed as attempting to impersonate the Ethereum brand, classifying the activity as brand impersonation.

VirusTotal analysis shows that 5 of 93 scanned security vendors flagged the domain as malicious, and the domain appears on a single known security blocklist, PhishDestroy, which has already taken it offline. Additional intelligence from AlienVault OTX records the domain in three separate threat pulses, reinforcing the malicious classification. The Gridinsoft trust score is 1 out of 100, indicating a very low reputation. No further technical artifacts such as malware payloads or credential‑stealing forms were observed in the limited scan; the page content beyond the title has not been captured, leaving the exact phishing kit or lure unknown.

Defenders should continue to block the IPv4 address 172.67.162.102 at the network perimeter, add safevexy.com to URL filtering and DNS sinkhole lists, and monitor for any future resolution changes. Continuous re‑scanning of the domain is advisable in case the host reactivates the site or modifies its content. Correlation with other Cloudflare‑hosted impersonation campaigns may help surface additional related infrastructure.