governance-dopplerfinance[.]app

This domain, governance-dopplerfinance.app, has been identified as a phishing site specifically targeting users of Doppler Finance, a decentralized finance platform. Analysis confirms the domain is actively impersonating the legitimate Doppler Finance brand, likely to harvest credentials, private keys, or other sensitive financial information from victims. The site remains operational at the time of this report, with no takedown or mitigation measures observed. Infrastructure analysis reveals the domain was registered on June 24, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in fraudulent domain registrations. The domain resolves to the IP address 188.114.96.3, which may be part of a content delivery network or hosting provider used to obscure the true origin of the malicious activity. Despite its active status, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating either recent deployment or evasion of current detection mechanisms. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy to unsuspecting users. The page title explicitly mimics Doppler Finance, reinforcing the impersonation attempt. Current risk assessment places this domain in an under-investigation status due to its recent creation, lack of detection, and active impersonation of a financial service. Organizations and users are advised to block the domain and IP address at the network level to prevent access. Security teams should monitor for connections to 188.114.96.3 and investigate any internal systems that may have interacted with the domain. Users who may have visited the site should revoke any active sessions, rotate credentials, and review financial transactions for unauthorized activity. Proactive reporting to relevant blocklist providers and financial sector ISACs is recommended to accelerate mitigation.