dexorbital[.]net

This domain is flagged as a high-risk cryptocurrency swap phishing site designed to harvest wallet credentials and private keys under the guise of a legitimate decentralized exchange. Analysis indicates the domain specifically mimics Dexlab, a known token swap platform, to deceive users into executing malicious transactions or disclosing sensitive authentication details. Infrastructure analysis reveals the domain dexorbital.net was registered on February 26, 2026, through Tucows Domains Inc. and currently resolves to IP address 188.114.97.3. Security vendor assessments on VirusTotal show 5 out of 95 engines detecting malicious activity, while Google Safe Browsing classifies it under SOCIAL_ENGINEERING. The domain appears on five security blocklists, including MetaMask, PhishDestroy, SEAL, OISD, and InversionDNS, and was previously accessible with the page title Swap | Dexlab. Its creation date, combined with the rapid flagging by multiple security entities, suggests a short-lived but targeted phishing campaign. Mitigation requires immediate blocking of the domain and associated IP address across all network security controls. Users who interacted with dexorbital.net should revoke any connected wallet permissions, rotate private keys, and audit transaction histories for unauthorized activity. Organizations should update endpoint detection rules to flag similar domains using the seed pattern 5180e4 in phishing kits. Security teams are advised to monitor for DNS queries to 188.114.97.3 and correlate logs with known cryptocurrency wallet addresses linked to the campaign. Proactive measures include deploying browser isolation for high-risk categories and enforcing multi-factor authentication for all decentralized finance interactions.