usenast[.]xyz

usenast.xyz was registered through Dynadot LLC on 26 November 2025. The domain resolves to the Cloudflare edge address 104.21.70.239, which is advertised as being located in the United States under ASN 13335 (Cloudflare, Inc.). DNS resolution is served by the authoritative nameservers donald.ns.cloudflare.com and hera.ns.cloudflare.com. No TLS certificate was observed for the host, indicating that HTTPS was not provisioned at the time of analysis.

The site’s HTML title reads "The MetaDEX that grows HYPE", and the listed scam type is brand impersonation targeting the brand "compound". The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. In the Open Threat Exchange, the domain is referenced in three separate threat‑intelligence pulses, confirming its relevance to ongoing investigations. VirusTotal scans returned 12 positive detections out of 95 security vendors, reflecting a moderate level of malicious labeling.

Independent reputation scoring from Gridinsoft assigned a trust score of 0 / 100, reinforcing the conclusion that the host is malicious. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer active. Defenders should continue to enforce DNS and URL filtering rules that block the domain and its associated IP address, monitor for any re‑registration attempts, and consider adding the host to internal blocklists. Ongoing observation of Cloudflare‑hosted IP ranges for similar brand‑impersonation activity is recommended, as the same infrastructure may be reused for future campaigns.