quickexchange[.]net

The domain quickexchange.net was a phishing site engaged in brand impersonation targeting Facebook users. It presented itself as a legitimate service but was designed to harvest login credentials through social media scams, specifically by mimicking Facebook's branding. No crypto drainer kit was detected. The site is currently taken offline.

Technical indicators confirm the elevated risk level. quickexchange.net was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0/100. Google Safe Browsing did not flag the domain, but it appeared on 1 security blocklist (PhishDestroy). The domain was registered through GMO Internet Group, Inc. d/b/a Onamae.com on August 31, 2023, and resolved to the IPv6 address 2400:8500:1301:162::18:1, hosted by GMO Internet Group, Inc. in Japan. The SSL certificate was issued by Let's Encrypt (E8), and the observed page title was 'Quick Exchange – 外貨両替機マップ'. Detected technologies included WordPress, MySQL, PHP, and LiteSpeed.

Victims of quickexchange.net should immediately change their Facebook passwords and enable two-factor authentication to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized posts or messages sent on their behalf. Report the phishing domain to Facebook via their official reporting channels and to the registrar, GMO Internet Group, Inc. Additionally, victims may submit the domain to Google Safe Browsing and other threat-intelligence platforms to aid in blocking future access.