dolomite-defi[.]gitbook[.]io

The domain dolomite-defi.gitbook.io was identified as a brand-impersonation site targeting Binance users. The page title returned by the server is "Welcome | Dolomite-Defi", and the site is classified as a crypto scam. Technical analysis shows the domain resolves to IP address 104.18.40.47, located in the United States and associated with AS13335 Cloudflare, Inc. The hosting provider is Cloudflare, as confirmed by the authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. TLS termination is performed by Google Trust Services under the WE1 certificate, indicating the use of a legitimate SSL certificate despite the malicious intent. HTTP probing returned a 403 status code, and the site is currently taken offline.

Security telemetry indicates the domain appears on one security blocklist and is blocked by PhishDestroy. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal scans show five of ninety‑five security vendors flag the site as malicious. The presence of Cloudflare and HTTP/3 technologies suggests the operator leveraged a reputable CDN to obscure origin infrastructure. The domain was originally registered on March 30, 2014 through Cloudflare, Inc., which aligns with the observed registrar data.

While the site is offline, the evidence points to a deliberate attempt to impersonate Binance and lure victims into a cryptocurrency‑related scam. Defenders should continue to monitor the IP address 104.18.40.47 for any re‑activation, enforce blocking of the domain in network and email filters, and update threat intelligence feeds with the observed indicators. Further investigation is needed to determine whether additional domains share the same hosting fingerprint or certificate, which could reveal broader campaign infrastructure.