doppler[.]finance[.]ski

The domain doppler.finance.ski is currently flagged as an active cryptocurrency wallet phishing site impersonating Doppler Finance, a decentralized finance platform. Analysis indicates the domain is designed to deceive users into disclosing wallet credentials or transferring digital assets under false pretenses. The site remains operational and exhibits elevated risk characteristics, including recent registration and confirmed malicious activity targeting financial services users. Infrastructure analysis reveals the domain is registered through GNAME.COM PTE. LTD. and resolves to the IP address 188.114.96.3, which is associated with content delivery networks commonly exploited for phishing operations. The site employs a Let's Encrypt SSL certificate to present a false sense of legitimacy, while detection metrics confirm its malicious nature: 15 of 95 security vendors on VirusTotal have flagged the domain as phishing-related. Additionally, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. Technologies detected include Cloudflare and HTTP/3, which are frequently leveraged to obfuscate malicious infrastructure and evade detection. Current assessment indicates the domain remains a credible threat to users of decentralized finance platforms. Organizations and individuals are advised to implement immediate countermeasures, including blocking the domain and its resolving IP at the network perimeter, updating endpoint protection rules to include this indicator of compromise, and alerting users to the presence of this phishing campaign. Given the domain's active status and confirmed malicious intent, continuous monitoring for related infrastructure and secondary attack vectors is recommended. Users who may have interacted with the site should revoke any connected wallet permissions and monitor accounts for unauthorized transactions.