dualcoin[.]cfd

The domain dualcoin.cfd has been confirmed as a high-risk brand impersonation site specifically targeting the Across cryptocurrency protocol. Analysis indicates the site was operational under the guise of a legitimate cryptocurrency exchange, presenting itself with the page title 'Dualcoin - The Best Cryptocurrency Exchange For You.' As of the latest assessment, the domain has been taken offline, though prior activity remains a significant concern for users who may have interacted with it during its active period. Infrastructure analysis reveals that dualcoin.cfd was registered through Porkbun LLC on October 10, 2025, and resolved to the IP address 62.60.226.213, hosted under AS214351 (FEMO IT SOLUTIONS LIMITED) in Germany. The domain lacks an SSL certificate, a common red flag in phishing operations. Detection metrics further substantiate its malicious nature, with 18 of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on five distinct security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB, reinforcing its classification as a confirmed threat. Given the domain's current offline status, the immediate risk of direct interaction has been mitigated. However, the infrastructure and registration details suggest potential for re-emergence under a similar guise. Users and organizations are advised to monitor for any resurgence of this domain or associated IPs in future campaigns. Network administrators should proactively block the IP address 62.60.226.213 and the domain dualcoin.cfd at the firewall or DNS level to prevent accidental access. Cryptocurrency users, particularly those affiliated with the Across protocol, should verify the authenticity of any platform before engaging, prioritizing official channels and multi-factor authentication to mitigate credential theft or asset compromise.