app[.]dexscreerer[.]net

PhishDestroy identifies app.dexscreerer.net as an active cryptocurrency wallet drainer site, masquerading under the guise of a legitimate DeFi tool. The domain leverages a spoofed branding strategy to mimic credible platforms, thereby tricking users into authorizing malicious transactions. Initial telemetry indicates this infrastructure is designed to siphon digital assets from unwitting victims, with the threat actor employing deceptive UI/UX patterns to facilitate unauthorized fund transfers. The seed identifier 8b6e8a has been linked to this campaign, suggesting a coordinated effort to deploy drainer kits against unsuspecting cryptocurrency users.

This domain exhibits several concerning technical attributes that warrant immediate scrutiny. VirusTotal currently scores it at 1/95 detections, indicating a lack of signature-based detection despite its malicious intent. The domain resolves to an IP address associated with hosting providers known for harboring fraudulent infrastructures. Registration details reveal a creation date within the last 12 months, suggesting a relatively new but rapidly operationalized threat. The registrar remains unconfirmed in public databases, while the SSL certificate is issued by Google Trust Services, a tactic often used to lend false legitimacy to phishing domains. Additionally, this domain has not yet been flagged by Google Safe Browsing or major threat intelligence blocklists, amplifying its potential for propagation.

As of the latest assessment, app.dexscreerer.net remains active, with no signs of takedown or remediation by hosting providers. The absence of detection underscores the sophistication of this campaign, which evades conventional security measures. Immediate actions for defenders include blocking the domain at the network perimeter and updating DNS sinkholes to prevent resolution. Users are strongly advised to verify URLs before interacting with DeFi platforms, enable transaction simulation tools where available, and report suspicious domains to threat intelligence platforms. The residual risk posed by this domain remains high, given its unchecked activity and the likelihood of further victimization. Proactive monitoring and threat hunting are critical to mitigating potential losses.