pearlexchange[.]xyz

PhishDestroy identifies pearlexchange.xyz as an active cryptocurrency phishing domain under investigation, posing as a legitimate exchange to deceive investors. This domain was flagged as a generic phishing threat on April 14, 2026, and remains unresolved on virus analysis platforms, with 0 detections out of 95 scans on VirusTotal as of seed 8442db. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 185.114.97.3, which hosts multiple instances of fraudulent activity. SSL certificates issued by Let’s Encrypt are in use, giving it an appearance of legitimacy despite malicious intent. This threat operates under a newly registered domain (NRD), a tactic commonly leveraged by cybercriminals to exploit the 45-day window before reputable blocklists identify and block the site. Currently, pearlexchange.xyz is not flagged on any public blocklists, maintaining a low detection profile while actively harvesting login credentials and cryptocurrency wallet information from unsuspecting users. The absence of detections on VirusTotal further suggests that traditional security tools have not yet flagged this domain, increasing its potential reach and impact. To mitigate exposure to this cryptocurrency phishing scam, users must verify the authenticity of any financial platform using official channels and reputable sources. Refrain from clicking links in unsolicited emails or advertisements promoting pearlexchange.xyz or similar domains. Enable multi-factor authentication on all cryptocurrency accounts and use dedicated hardware wallets for storage. Reporting this domain to cybersecurity platforms such as PhishDestroy or local fraud units can accelerate its inclusion on blocklists, protecting others from similar threats.