duplicate-disabled-1082549.invalid was an impersonation phishing page that presented itself simply as an "exchange". It targeted crypto users who believed they were signing up with or logging into a legitimate trading platform. PhishDestroy first flagged it on 2026-09-10. The site has been offline since 2026-09-25 and was still dead when last checked on 2026-10-19.
How the scam works
Fake exchanges like this one mimic a real trading dashboard to win the visitor's trust. They then either harvest the account credentials typed into the login form or push the victim to deposit crypto into a balance that only exists on screen. The generic page title "exchange" fits a template built to pass as any platform. When a victim tries to withdraw, this kind of operation typically demands extra "fees" or "taxes" before releasing funds that were never really held. Victims can lose the deposits, those follow-up payments, and access to any real exchange account whose password was reused.
Evidence
On 2026-09-18, VirusTotal showed 12 of 89 engines flagging the domain, among them BitDefender, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, alphaMountain.ai and the Vietnamese anti-scam group Chong Lua Dao. That is a modest count, but it comes from a broad mix of commercial and community sources. urlscan.io returned a malicious verdict and tagged the page as a cryptoscam. The domain also appears in 4 AlienVault OTX threat pulses, which shows other researchers tracked it independently.
Infrastructure
The domain was registered on 2017-05-10 through Gname.com Pte. Ltd., more than nine years before it was caught serving this page. An aged name like this can slip past filters that distrust freshly registered domains. The site was hosted on VH Global Limited's network in Hong Kong at 103.24.217.234. It used a free Let's Encrypt certificate, so the browser padlock said nothing about whether the site was genuine.
What to do
If you deposited crypto here, do not pay any "withdrawal fee" or "verification charge" promising to unlock your balance, because that money goes to the same people. Report the transfers to your exchange and to local police, and keep the transaction IDs. Change the password on any real exchange or email account that shares credentials with what you typed, and turn on app-based 2FA. Be wary of "recovery services" that contact you afterward. Defenders should block the domain and its Hong Kong hosting IP and check logs for past visits from their users.
DOM Analysisanalyzed 2026年9月17日score 98/1003 brand signals
Favicon Hash
ICANN OVERSIGHT
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(SG)
