dragoncitygames[.]com

This domain, dragoncitygames.com, operates as a credential harvesting platform specifically targeting users of a major cryptocurrency exchange. Analysis indicates the site presents a fraudulent interface mimicking the legitimate exchange's login and authentication workflows, designed to capture sensitive account credentials, two-factor authentication codes, and recovery phrases. The page title 'Dragon City' serves as a weak obfuscation attempt, while the underlying infrastructure and content structure align with known exchange impersonation tactics observed in prior campaigns. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to 172.66.0.70, hosted on Cloudflare's AS13335 network, a common evasion tactic to conceal origin servers. Registered through GoDaddy.com, LLC on December 29, 2025, the domain remains unencrypted with no SSL certificate present. Detection metrics show 13 of 95 security engines on VirusTotal flagging the domain as malicious, while three distinct security blocklists have incorporated it into their threat feeds. Additional automated systems have independently classified this as a brand impersonation threat, with confirmed blocking by multiple domain reputation services. Users who accessed dragoncitygames.com or entered credentials on any page resembling the targeted exchange interface should immediately revoke active sessions and rotate all authentication factors. Monitor associated accounts for unauthorized transactions or configuration changes, particularly those involving withdrawal addresses or API key generation. If cryptocurrency transfers were initiated, document all transaction hashes and contact the legitimate exchange's security team with the collected evidence. Network administrators should add the domain and associated IP 172.66.0.70 to internal blocklists to prevent further exposure within organizational environments.