dodoexchange[.]live

Analysis of dodoexchange.live indicates a confirmed fake cryptocurrency exchange phishing operation, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, through Web Commerce Communications Limited (WebNic.cc) and resolved to IP address 104.21.53.186, hosted on Cloudflare's network (AS13335). The SSL certificate is issued by WE1, a low-assurance provider commonly associated with malicious infrastructure.

While the domain now returns a 404 Not Found page, earlier intelligence confirms its classification as a fake exchange scam, with detection by 18 of 93 security vendors on VirusTotal and presence on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain appears in one AlienVault OTX threat intelligence pulse, further corroborating its malicious status. Nameservers ns100.webnic.cc and ns101.webnic.cc are consistent with the registrar's infrastructure, though this alone is not indicative of compromise.

Defenders should treat this domain as high-risk and maintain blocking rules, as the infrastructure may be reused for future phishing campaigns. The exact content and targeting methods of the site remain unconfirmed due to its offline status, but the available indicators align with known fake exchange phishing patterns. No legitimate use case is identified for this domain.