nokyc[.]vip

This domain is flagged as an elevated-risk generic phishing threat targeting cryptocurrency users under the guise of an anonymous, no-KYC exchange. Analysis indicates the infrastructure was designed to deceive victims into disclosing wallet credentials or transferring funds to attacker-controlled addresses, leveraging the growing demand for privacy-focused crypto services. The domain’s page title, 'Anonymous Crypto Exchange | No KYC,' directly exploits this trend, while its technical setup suggests an intent to evade casual scrutiny through the use of modern web protocols and obfuscation services.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain nokyc.vip resolves to IP address 188.114.97.3 and was registered on May 14, 2026, through NameSilo, LLC, a registrar frequently associated with abuse. It is detected by 8 out of 95 security vendors on VirusTotal and appears on four independent security blocklists, including those maintained by wallet security providers and domain reputation systems. Additional technical artifacts include the use of Cloudflare for hosting and traffic obfuscation, HTTP/3 for performance, and HSTS to simulate legitimacy. A trust score of 0/100 from Gridinsoft further corroborates the domain’s malicious classification. The domain is currently offline, though historical activity suggests it may resurface under similar naming conventions or infrastructure.

Mitigation against this threat type requires a multi-layered approach. Users should verify the legitimacy of any platform advertising no-KYC crypto services by cross-referencing official sources and domain registration details, particularly noting creation dates that predate the claimed service launch. Wallet software and browser extensions that block known phishing domains should be enabled, and users should treat unsolicited offers of anonymous trading with skepticism. Organizations managing crypto infrastructure are advised to preemptively block the domain and its associated IP at the network level, monitor for related domains using similar naming patterns, and educate users on the risks of interacting with unverified exchanges, especially those hosted on newly registered or low-reputation domains.