dexlab-space[.]ai-cryptolist[.]net

Analysis indicates that dexlab-space.ai-cryptolist.net is currently active and classified as a high‑risk generic phishing site. The domain was registered on April 11, 2026 through Key‑Systems GmbH and has been observed serving HTTP 403 responses, a behavior often used to hide malicious payloads while still establishing a reachable foothold.

Infrastructure assessment shows the domain resolves to 104.21.68.219, an IP address owned by Cloudflare, Inc. and located in Canada. The authoritative nameservers are melissa.ns.cloudflare.com and miles.ns.cloudflare.com, both typical of Cloudflare‑hosted services. The TLS certificate is issued by Google Trust Services under the WE1 branch, confirming the presence of a valid HTTPS layer despite the underlying malicious intent.

Threat intelligence sources report a Gridinsoft trust score of 0 out of 100, reflecting the worst possible confidence rating. VirusTotal analysis returned a single positive detection out of 95 scanned security vendors, indicating that at least one vendor has flagged the domain as malicious. The domain appears on one public blocklist and is actively blocked by PhishDestroy, suggesting that defensive communities have begun to surface the threat.

Defenders should add 104.21.68.219 and the domain dexlab-space.ai-cryptolist.net to outbound and inbound deny lists, monitor DNS queries for the associated Cloudflare nameservers, and enforce TLS inspection to verify certificate details. Continuous re‑scanning on VirusTotal and similar platforms is advised to capture any escalation in detection counts. Because the registration date is recent, threat actors may still be refining their campaign, so proactive monitoring of related subdomains and newly created registrations from Key‑Systems GmbH is recommended.