dodoex[.]trade

Analysis of dodoex.trade indicates an active malicious infrastructure targeting cryptocurrency users. The domain was registered on May 18, 2026 through Gandi SAS and resolves to IP 187.77.66.108, a Hostinger server located in Germany. TLS is provided by a Let’s Encrypt certificate (YE2) and the site returns HTTP 200 with the page title “Cryptocurrency exchange online | First crypto exchange platform - 1mile,” matching the reported scam type of a fake exchange. The domain appears on three security blocklists and has been referenced in a single AlienVault OTX pulse. Independent scanning on VirusTotal recorded four detections out of ninety‑two vendors. Current defensive feeds have already blocked the domain via PhishDestroy, MetaMask, and SEAL. While the page content beyond the title has not been publicly examined, the combination of a recent registration, hosting on a shared provider, and alignment with known fake‑exchange tactics suggests a high‑risk profile. Defenders should add dodoex.trade to URL filtering rules, monitor DNS queries for the listed nameservers (ns-661.awsdns-18.net, ns-1482.awsdns-57.org, ns-197.awsdns-24.com, ns-17...), and consider broader threat‑intel sharing to prevent credential harvesting or financial loss.