daims-ftx[.]com

The domain daims-ftx.com has been identified as a phishing site specializing in cryptocurrency exchange impersonation, specifically targeting users with fraudulent login portals. Analysis indicates this domain is designed to mimic legitimate exchange platforms, potentially harvesting credentials for unauthorized account access or fund theft. As of the latest assessment, the domain is currently offline, though prior activity suggests it was actively deployed in malicious campaigns. Infrastructure analysis reveals the domain was registered on October 17, 2025, through the registrar Gname.com Pte. Ltd. It resolved to the IP address 178.16.54.185, hosted in the Netherlands under AS202412 (Omegatech LTD). Security vendor detection on VirusTotal shows 15 of 95 engines flagged the domain as malicious, while it appears on at least one security blocklist. The absence of an SSL certificate further reduces its legitimacy, as modern phishing sites typically employ encryption to evade detection. The page title, Plesk Obsidian 18.0.74, suggests the use of a default hosting control panel interface, a common tactic to disguise malicious infrastructure as benign server pages. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the risk remains elevated for users who may have interacted with the site prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts on cryptocurrency accounts, particularly those associated with exchange platforms. Network administrators should block the IP address 178.16.54.185 and the domain daims-ftx.com at the perimeter level. Users who entered credentials on this site should immediately rotate passwords and enable multi-factor authentication on all financial and exchange-related accounts. Vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains.