dolphin-exchange[.]com

The domain dolphin-exchange.com was registered on 21 February 2026 through Web Commerce Communications Limited. It hosts a website whose title is “Buy” and returns HTTP 200 responses. The site is currently active and has been classified as a fake cryptocurrency exchange used in a phishing campaign. The domain’s trust score from Gridinsoft is 0 out of 100, and it is listed on at least one public blocklist, with PhishDestroy already blocking it.

Infrastructure analysis shows the domain resolves to 172.67.177.186, an IP address owned by Cloudflare, Inc. (AS13335) and located in the United States. DNS resolution is served by the authoritative nameservers cody.ns.cloudflare.com and gigi.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a standard HTTPS configuration without certificate anomalies.

Technical profiling reveals a modern JavaScript stack: Node.js, Vue.js, Nuxt.js, Chart.js, with assets delivered via jsDelivr, cdnjs, Google Analytics, and Facebook Pixel. The presence of financial charting libraries aligns with the reported “Fake Exchange” scam type, suggesting the site mimics legitimate trading platforms to harvest credentials. VirusTotal analysis flags the domain on 2 of 95 scanners, reinforcing the suspicion of malicious intent. No additional intelligence on payload delivery or credential harvesting endpoints is presently available.

Defenders should block traffic to dolphin-exchange.com at the network perimeter and add the domain to DNS sinkhole lists. Monitoring should extend to outbound connections to the identified Cloudflare IP and to the associated nameservers. Since the site leverages common CDN and analytics services, detection may require heuristic inspection of request patterns, especially POST submissions to pages resembling login or transaction forms. Continued observation of VirusTotal and other threat feeds is advised to capture any escalation or new indicators of compromise.