saros-exchange[.]com

The domain saros-exchange.com is a confirmed phishing site engaged in brand impersonation targeting Chainlink users. It presents itself as a cryptocurrency exchange under the name 'Saros Exchange' with the page title 'Buy/Sell Bitcoin, Ether and Altcoins | Cryptocurrency Exchange | Saros Exchange', but operates as a crypto scam designed to deceive victims into transferring digital assets. No drainer kit was identified, and the site is currently taken offline.

Technical indicators confirm the malicious nature of saros-exchange.com. The domain was registered on 2025-05-31 12:09:57 through NameCheap, Inc. and resolves to the IP address 172.67.140.190, hosted on Cloudflare infrastructure in the US (AS13335). Security vendors flagged it with 3 of 95 detections on VirusTotal, including Gridinsoft (trust score 0/100) and SOCRadar, while it appears on one security blocklist (PhishDestroy). The domain lacks an SSL certificate, and its nameservers are addyson.ns.cloudflare.com and cosmin.ns.cloudflare.com. Google Safe Browsing has not flagged the domain.

Victims of saros-exchange.com should immediately revoke any token approvals granted to the site and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts, enable two-factor authentication, and monitor for unauthorized transactions. Report the phishing domain to Chainlink’s official security team, the registrar (NameCheap), and platforms like Google Safe Browsing or PhishTank to aid in takedown efforts.