dexchang[.]net

On 24 July 2026 the domain dexchang.net was observed hosting a fraudulent cryptocurrency exchange front. The site’s HTML title reads “Dex Exchange | Моментальный обмен криптовалют”, indicating an attempt to present a rapid crypto‑swap service. The domain was registered on 21 February 2026 and resolves to the Cloudflare address 172.67.172.152, an IP block (AS13335) owned by Cloudflare, Inc. The SSL certificate is identified as “WE1”, which is typical for Cloudflare‑issued certificates but provides no assurance of legitimacy. VirusTotal records show that 1 out of 93 scanning engines flagged the domain, suggesting at least one vendor detected malicious behavior.

The domain appears on four independent blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, each classifying it as a fake exchange. Current network probes indicate the host is offline, matching the “taken offline” status reported by the intelligence feed. Evidence confirms the domain’s primary threat vector is a fake exchange that may lure victims into depositing cryptocurrency under false pretenses. No additional indicators such as malicious payload hashes, command‑and‑control endpoints, or phishing page screenshots have been released, leaving the full scope of the campaign uncertain.

Defenders should block DNS resolution for dexchang.net, add the associated IP 172.67.172.152 to deny‑list rules where feasible, and monitor traffic for attempts to contact the domain or its IP. Because the site leverages Cloudflare’s infrastructure, typical network‑level blocking may be limited; employing URL filtering or reputation‑based web proxy rules is recommended. Security teams should also update endpoint detection signatures with the single VirusTotal detection and ensure that any alerts from the listed blocklists trigger incident response workflows. Continuous re‑assessment is advised in case the domain is re‑hosted or the threat actors shift to new infrastructure.