ekiden[.]exchange

PhishDestroy identifies ekiden.exchange as an active crypto drainer phishing domain operating under an elevated threat classification. This domain is designed to impersonate legitimate cryptocurrency exchange login interfaces, tricking users into entering credentials or transferring assets to attacker-controlled wallets. The campaign is currently active and poses a direct financial risk to unwary traders or investors.

This domain was flagged by 1 of 95 VirusTotal security vendors, indicating limited but confirmed malicious detection. ekiden.exchange is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 188.114.97.3, and uses a Let’s Encrypt SSL certificate to appear legitimate. The domain was created on May 05, 2026, suggesting it is a recently deployed threat infrastructure. Despite its new registration, it has already been listed on one blocklist, with trust scores reflecting high-risk characteristics.

Given the active status and confirmed malicious nature, users are strongly advised to avoid interacting with ekiden.exchange or any linked pages. If you encounter this domain—via email, social media, or search results—do not enter any login credentials, download files, or engage in transactions. Verify the legitimacy of any cryptocurrency-related site using PhishDestroy’s real-time threat intelligence. Report the domain immediately to your security team or via PhishDestroy’s platform to help disrupt the campaign. Proactive domain blocking at the network firewall and email gateway is recommended to prevent accidental exposure.