turbo-exchange[.]su

Analysis of the domain turbo-exchange.su indicates it was operating as a fake cryptocurrency exchange, as classified in available threat intelligence. The domain was created on February 21, 2026, and is currently offline. Infrastructure analysis reveals it resolved to IP 212.192.14.26, hosted on AS207713 (GLOBAL INTERNET SOLUTIONS LLC) in Russia. The SSL certificate is issued by R3, a common intermediate CA, which provides no inherent indication of malicious activity but is consistent with phishing domains leveraging standard encryption.

The page title, 'Сайт turbo-exchange.su припаркован на 4host.pro,' suggests the domain was parked or hosted on 4host.pro, though the exact relationship between the hosting provider and the phishing content remains unclear. The domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt, which flagged it as malicious prior to takedown. No active detections were recorded by VirusTotal at the time of scanning, though this does not confirm the domain's safety or legitimacy. Defenders should treat this domain as compromised infrastructure.

While the site is offline, the registration and hosting details may assist in identifying related campaigns. Monitoring for re-registration or reuse of the IP (212.192.14.26) or hosting provider (4host.pro) is recommended. The absence of a known phishing kit or additional brand impersonation details limits further attribution, but the classification as a fake exchange aligns with the observed domain naming convention and blocklist categorization.