simba-exchange[.]finance

The domain simba-exchange.finance was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently taken offline. Infrastructure analysis shows the domain resolves to IP 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is hosted in the United States. The site used Cloudflare’s DNS service, with authoritative nameservers kobe.ns.cloudflare.com and brynne.ns.cloudflare.com, and advertised support for HTTP/3. No SSL certificate was observed, indicating that HTTPS was not enforced at the time of takedown.

The page title returned by the server, “Simba Exchange | Self‑Custodial Order‑Book DEX on Sei”, and the declared impersonation of the Sei brand identify the operation as a fake exchange targeting users of the Sei blockchain ecosystem. Reputation signals are extremely poor: the Gridinsoft trust score is 0 / 100, and four of ninety‑three VirusTotal scanners flagged the domain as malicious. The domain is listed on a single security blocklist and has been blocked by PhishDestroy. The combination of a brand‑impersonating page title, a zero‑trust score, and multiple vendor detections strongly suggests a credential‑harvesting or fund‑exfiltration campaign aimed at deceiving Sei users.

Uncertainty remains regarding the exact payload or data collection mechanisms, as no samples or post‑exploitation activity have been publicly released. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP and Cloudflare nameservers, and alert users of the Sei community about the fraudulent “Simba Exchange” service. Continuous watch of VirusTotal updates and any emerging threat‑intel feeds covering this indicator is recommended to detect potential re‑hosting or related infrastructure.