crypto-exchange-safety[.]top

Analysis of crypto-exchange-safety.top indicates a confirmed credential-phishing operation targeting cryptocurrency exchange users. The domain, registered on April 28, 2026, via PDR Ltd, currently resolves to IP address 76.76.21.21 and is actively flagged by four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. The page title, 'TradeOgre Login Safety & Crypto Exchange Checklist | Independent Guide,' suggests an attempt to impersonate TradeOgre or related cryptocurrency exchange services to harvest login credentials. Threat intelligence platforms report the domain in 23 AlienVault OTX pulses, reinforcing its malicious classification. Gridinsoft and Scamadviser both assign a trust score of 1/100, further corroborating its high-risk status. While 13 of 95 security vendors on VirusTotal flag the domain as malicious, the absence of detections from the remaining vendors does not diminish the confirmed phishing activity. The SSL certificate, issued by Let's Encrypt, is standard for both legitimate and malicious sites and provides no indication of safety. Defenders should treat this domain as an active threat. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or user credentials. Given the domain's recent creation and ongoing activity, monitoring for related infrastructure (e.g., subdomains, newly registered lookalike domains) is advised. No evidence currently links this domain to a specific phishing kit or broader campaign, but the targeting of cryptocurrency exchange credentials aligns with common credential-theft tactics observed in 2026.