gitexchbot[.]com

The domain gitexchbot.com was registered on 2026-02-21 and is currently taken offline according to the latest intelligence. DNS resolution points to the address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The site presented the page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Exchange” and used an SSL certificate labeled WE1. Threat analysis categorises the activity as a crypto‑scam that impersonates the decentralized exchange 1inch.

VirusTotal scans returned nine positive detections out of ninety‑three vendors, indicating that multiple security products have flagged the domain as malicious. The domain appears on one public security blocklist and is also listed as blocked by PhishDestroy. Independent reputation scoring from Gridinsoft assigned a trust score of 0 / 100, reinforcing the assessment of high malicious intent. Infrastructure analysis reveals that the hosting is behind Cloudflare, which can mask the true operator location, while the IP address and SSL fingerprint provide concrete technical indicators.

No additional details about the phishing kit, command‑and‑control infrastructure, or associated domains have been disclosed. Defenders should continue to block gitexchbot.com at DNS and firewall levels, incorporate the observed indicators—IP 188.114.96.3, SSL certificate WE1, and the exact page title—into detection rules, and monitor blocklist updates for any re‑registration attempts. Periodic rescanning with VirusTotal and revisiting the blocklist status are recommended to capture any changes in detection coverage. The elevated risk rating assigned to this domain underscores the need for proactive mitigation in environments that handle cryptocurrency transactions or monitor 1inch‑related traffic.