o1-exchange[.]net

This domain, o1-exchange.net, was registered on July 23, 2026, through Fewmoretaps OU d/b/a Trustname.com. Analysis indicates it is currently active and resolving to the IP address 186.2.175.109. The domain is flagged by PhishDestroy and appears on one security blocklist, though no detections were recorded by the 91 vendors that scanned it on VirusTotal as of the latest assessment. The absence of detections does not confirm the domain is safe, particularly given its recent registration and presence on a blocklist.

Infrastructure analysis reveals the domain uses nameservers ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com. The hosting IP 186.2.175.109 has not been linked to previously confirmed malicious activity in the available data, but the nameserver configuration suggests shared or reseller hosting, which is common in phishing campaigns. The domain's registration date aligns with typical phishing lifecycle patterns, where domains are often spun up and used within days of creation. Defenders should treat this domain as a potential phishing threat targeting cryptocurrency users, based on its naming convention and the broader context of similar domains.

The exact content of the site is not yet analyzed, but the domain name suggests an attempt to mimic a legitimate cryptocurrency exchange or wallet service. Organizations should consider blocking the domain at the network level and monitoring for connections to 186.2.175.109. Security teams are advised to review logs for any interactions with this domain or IP, particularly in environments where cryptocurrency-related services are accessed. Further investigation is recommended to determine the specific tactics, techniques, and procedures (TTPs) employed by this campaign.