dexscreenerc[.]com

PhishDestroy identifies dexscreenerc.com as a live phishing domain masquerading as the legitimate DexScreener service. The infrastructure leverages a deceptive clone of the real DexScreener site—identical branding and layout—to harvest wallet credentials and seed phrases under the guise of token verification. No drainer kit artifacts are yet confirmed, but the page behavior matches classic crypto-draining kits observed in similar campaigns. The domain’s sole purpose is to trick users into connecting wallets and signing malicious transactions that drain funds to attacker-controlled addresses. Victims report sudden token losses minutes after granting permissions, consistent with clipboard or approval-phishing attacks.

Technical indicators confirm high-risk traits: VirusTotal shows 9/95 detections as of latest scan, indicating the domain remains undetected by AV engines. It resolves to IP 188.114.97.3 via a Let’s Encrypt SSL certificate, adding false legitimacy. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 23, 2026—an unusually recent creation likely intended to evade historic blocklists. Google Safe Browsing currently lists the domain as clean, while third-party blocklist aggregators show zero prior detections. These fresh indicators suggest an early-stage campaign still flying under security radars.

Current status is active with no takedown initiated. Immediate action is required: block the domain at DNS/edge levels and flag the IP range. Users should avoid visiting dexscreenerc.com and verify all DexScreener links via official channels. Remaining risk remains high while the domain remains accessible and undetected by major scanners. SOC teams are advised to hunt for related domains and monitor for wallet drain events linked to this campaign.