exchangepair[.]com

exchangepair.com was observed hosting a cryptocurrency‑related brand impersonation campaign targeting Ethereum users. The site’s page title “Exchange Pairs” and the classification as a crypto scam indicate that the operator attempted to lure victims with a purported exchange service. Registration data shows the domain was created on 28 October 2024 and was registered through HOSTINGER operations, UAB. DNS resolution points to the IPv4 address 185.253.218.211, which belongs to AS202302 NETH LLC and is geolocated in Ukraine. The server presented an SSL certificate identified as “R13”, a low‑trust certificate commonly associated with malicious infrastructure.

Reputation services have flagged the domain: Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy lists the domain as blocked. VirusTotal scans returned detections from 14 of 93 security vendors, confirming malicious content. AlienVault OTX includes the domain in one threat‑intelligence pulse, and a single security blocklist currently lists the domain. The domain is presently offline, as indicated by the status field, and no further HTTP response data are available. Analysis indicates that the primary threat vector is brand impersonation of Ethereum, likely used to harvest private keys or credentials under the guise of an exchange service.

The limited number of detections and blocklist entries suggest a relatively recent or low‑volume operation, but the presence of multiple vendor detections and a zero‑trust score underscores a high likelihood of malicious intent. Uncertainty remains regarding the exact payload delivered to victims, the persistence of the hosting infrastructure, and whether additional domains share the same backend. Defenders should add exchangepair.com to blocklists and URL filtering rules, monitor DNS queries for the resolved IP address, and enforce TLS inspection to capture any encrypted payload.