doppler-finance[.]us

The domain doppler-finance.us has been identified as a generic phishing threat, specifically a crypto drainer designed to impersonate the legitimate Doppler Finance DeFi protocol on the XRP Ledger. This site attempts to trick users into connecting their wallets or providing private keys under the guise of offering swap, bridge, staking, and lending services. The threat is classified as high risk due to its active status and the potential for significant financial loss.

Technical indicators reinforce the danger of this domain. VirusTotal reports that 5 out of 95 security vendors flag it as malicious, and it appears on three security blocklists. The domain was registered through GoDaddy.com, LLC and created on May 12, 2026, which is unusually recent and suggests a short lifespan typical of phishing operations. It resolves to IP address 172.67.167.159 and uses an SSL certificate issued by Let's Encrypt (E7), which provides a false sense of security. Google Safe Browsing status is not explicitly provided but given the blocklist presence, it is likely flagged.

As of the current analysis, the domain remains active and continues to pose a threat to users. PhishDestroy recommends that users avoid interacting with this site entirely. If any credentials or wallet connections were made, immediate action should be taken, such as revoking permissions and transferring assets to new wallets. The remaining risk is high, as the site may still be operational and targeting unsuspecting victims. Users are strongly advised to verify all DeFi protocols through official channels and use PhishDestroy's database to check for similar threats.