Protocol-impersonator domain registered (typosquat)

Evidence summary #

compoond.finance typosquat registered ~Mar 7, 2026 (49 days before 2026-04-27 assessment — within 90-day window). Used to redirect compound.finance traffic. Resolved. Previous incident Jul 2024. Two confirmed impersonation incidents in 21 months.

Detail #

compoond.finance was registered approximately March 7, 2026 (WHOIS referenced in coinspectator.com/2026/03/08 article). The domain was used to redirect compound.finance traffic for a brief window, confirmed as an active phishing redirect. Source: Protos 2026-03-08 ('DeFi Lending Platform Compound Finance Hijacked Again'), coinspectator.com 2026-03-08, comp.xyz SSP security update thread 7675. The domain redirect was resolved via credential rotation. The prior incident (Jul 2024) involved Squarespace domain migration vulnerability — different attack method but same surface. Both incidents are within 21-month window. Domain is 49 days old at assessment date — within the 90-day detection window per RD-F-161 definition.

Sources #

Methodology #

Determine whether a typosquat of the official protocol domain has been registered in the last 90 days.

See the full factor methodology and distribution across all protocols →