dcoin-login-exchange[.]com

The domain dcoin-login-exchange.com was registered on October 29, 2024 through NiceNIC International Group Co., Limited and is currently taken offline. Infrastructure analysis shows the hostname resolves to IP address 185.149.120.107, which belongs to AS57724 DDOS-GUARD LTD and is geolocated in Russia. No SSL certificate is present, indicating that communications are unencrypted and that the site does not meet basic security hygiene standards. The page title returned by the server is "Dcoin Login & Dcoin Exchange | Dcoin Login Trading Platform," confirming the use of the Dcoin brand in the credential phishing campaign.

Trust metrics are extremely low, with Gridinsoft assigning a score of 0 out of 100 and Scamadviser rating the domain at 1 out of 100. VirusTotal scans have flagged the domain by 7 of 95 security vendors, and the site appears on a single security blocklist. It has been actively blocked by the PhishDestroy mitigation service, reinforcing its classification as a malicious credential harvesting site.

Defenders should continue to block the domain at network perimeters, update URL filtering rules, and monitor the associated IP address for any resurgence of activity. Because the site is offline, the immediate threat surface is reduced, but the underlying infrastructure—particularly the hosting provider and registrar—may be reused for future campaigns, so ongoing vigilance is advised. Further analysis of the single nameserver and any residual DNS records could provide additional intelligence on the operator’s infrastructure.