getdoloxi[.]com

This domain, getdoloxi.com, is an active brand impersonation threat targeting Binance users. The site presents itself as a legitimate cryptocurrency trading and investment platform, using Binance’s branding to deceive visitors into entering sensitive account credentials or transferring funds. Such impersonation schemes typically harvest login details for unauthorized access to wallets or exchange accounts, leading to financial theft or further exploitation through social engineering. Analysis indicates this domain was registered on July 9, 2024, through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains. Security vendors on VirusTotal have flagged it as malicious, with 3 out of 95 engines detecting it as a threat. The domain resolves to the IP address 188.114.97.3 and is currently blocked by one security blocklist, PhishDestroy. Additional technical indicators include the use of jQuery and Cloudflare services, which are often leveraged to obscure malicious activity or enhance site performance to appear more legitimate. If you have visited getdoloxi.com or interacted with its content, immediate action is required. Disconnect the device from the network to prevent potential data exfiltration. Reset passwords for any accounts accessed on the site, particularly Binance or other cryptocurrency-related services, using a separate, secure device. Enable multi-factor authentication where available. Scan the device for malware using updated security tools, and monitor financial accounts for unauthorized transactions. Report the incident to the impersonated brand’s official fraud team for further investigation and mitigation.