dexxbet[.]cc

On July 24, 2026, dexxbet.cc was observed as an active generic phishing infrastructure. The domain was registered on June 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently served by Cloudflare nameservers mallory.ns.cloudflare.com and olof.ns.cloudflare.com. DNS resolution points to the IPv4 address 172.67.198.191, which is part of Cloudflare’s edge network. The domain appears on a single public security blocklist and has been blocked by the PhishDestroy feed. VirusTotal analysis shows that four of ninety‑one scanning engines flagged the domain, indicating a modest detection rate.

No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available in the current dataset, leaving the exact phishing payload and targeted brand undefined. The limited detection footprint suggests the campaign may be in an early deployment phase or employing evasion techniques that reduce visibility. The risk level assigned as high reflects the domain’s recent creation, active status, and the presence of multiple security vendor detections, which together increase the likelihood of credential harvesting attempts. Organizations that rely on credential‑based authentication should treat any login attempts to dexxbet.cc as malicious and enforce multi‑factor authentication. Network defenders should also inspect TLS handshake data for the Cloudflare‑issued certificate, even though the certificate details are not disclosed, to verify that the connection is not being used for legitimate services.

Correlation with internal phishing simulation logs may reveal whether the domain is already being targeted in phishing emails. Given the lack of publicly available page content, threat analysts should request a controlled browse of the URL in a sandboxed environment to extract page title, form fields, and any embedded malware indicators.