dcqep[.]com

The domain dcqep.com was identified as a phishing infrastructure targeting users of decentralized finance (DeFi) platforms under the guise of a legitimate Ethereum-based service, specifically impersonating "defi-ETH". Analysis confirms the domain is currently offline, though it was previously operational and flagged for malicious activity. Infrastructure analysis reveals dcqep.com was registered through eName Technology Co.,Ltd. on December 23, 2024, and resolved to the IP address 104.21.13.124. Security assessments indicate low trust scores, with Gridinsoft assigning a 0/100 rating and Scamadviser providing a 31/100 score. The domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports 2 of 95 security vendors flagging the domain as malicious, while AlienVault OTX includes it in two threat intelligence pulses. The page title "defi-ETH" aligns with tactics used to deceive users into interacting with fraudulent DeFi services. Current status confirms dcqep.com has been taken offline, though the infrastructure may resurface under alternate domains or IPs. Organizations and users are advised to block the domain and associated IP at perimeter defenses. Security teams should monitor for indicators of compromise, including wallet addresses or transaction hashes linked to this campaign. Users who interacted with the domain should revoke any connected smart contract permissions and conduct a thorough audit of their crypto wallets for unauthorized transactions. Proactive threat hunting for related domains registered through the same registrar or resolving to the identified IP is recommended.