# PhishDestroy domain threat record: dexmines.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dexmines.io/
Machine-readable companion: https://phishdestroy.io/domain/dexmines.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-12 06:21:16 UTC
- Last availability or vendor check: 2026-10-22 10:59:48 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.39.16
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 301
- Registration date (registry RDAP, dexmines.io): 2026-08-15 10:11:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a12b6d-6fa0-7658-8f88-a74f2bc5f440/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dexmines.io
- Certificate Transparency search: https://crt.sh/?q=%25.dexmines.io
- Web Archive lookup: https://web.archive.org/web/*/https://dexmines.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
dexmines.io is a domain on the PhishDestroy blocklist. Its name combines "DEX" and "mines", which suggests decentralized trading or crypto mining, so it is likely aimed at crypto users. No specific brand impersonation has been confirmed. PhishDestroy first flagged it on 2026-10-12, and it was still online on 2026-10-19, where it redirected visitors elsewhere instead of serving its own page.

How the scam works
We have not yet tied this domain to a specific scheme. The strongest signals are Spamhaus's phishing listing and several security vendors that flag it, and both point to a site built to take something from visitors. With a crypto-themed name, that usually means login details, a seed phrase, or a wallet connection that leads to a malicious signature. The active redirect matters here: a link that looks like it goes to dexmines.io can send people to a different destination, and that destination can be changed at any time.

Evidence
On 2026-10-16, VirusTotal showed 7 of 92 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar and VIPRE. That is a minority of engines, but the vendors are unrelated and reached the same verdict independently. Spamhaus lists the domain in its DBL under the phishing category, a listing many mail filters enforce. Four AlienVault OTX threat pulses also reference it, which shows other researchers are tracking the domain as well.

Infrastructure
The domain resolves to Cloudflare's network, with the address geolocated to Canada. Because Cloudflare acts as a reverse proxy, the server that actually hosts the content is hidden from public view. The Google Trust Services certificate is the standard one issued for Cloudflare-fronted sites, so the padlock in the browser says nothing about whether the site can be trusted.

What to do
If you visited dexmines.io without entering anything, close the tab and do not follow its redirect again. If you typed in a password, change it everywhere you reuse it and turn on app-based 2FA. If you entered a seed phrase, assume the wallet is compromised and move your funds to a new wallet. If you connected a wallet and signed anything, review and revoke unfamiliar token permissions. Defenders should block the domain at DNS and mail gateways and watch for internal links pointing to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12b6d-6fa0-7658-8f88-a74f2bc5f440/
VirusTotal report: https://www.virustotal.com/gui/domain/dexmines.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dexmines.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:39:03 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a12b6d-6fa0-7658-8f88-a74f2bc5f440.png
  Captured: 2026-10-12 06:21:16 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a12b6d-6fa0-7658-8f88-a74f2bc5f440.png
  Source report: https://urlscan.io/result/01a12b6d-6fa0-7658-8f88-a74f2bc5f440/
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12ec7-50d6-7108-9ed2-d0416e48f87b.png
  Captured: 2026-10-12 06:23:04 UTC
  Source report: https://urlscan.io/result/01a12ec7-50d6-7108-9ed2-d0416e48f87b/
  SHA-256: 2bef5aa54f20d5cb4d5aa8197d75f92d980e2313ca01829978c493dfc76f908c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:53:11Z",
        "uuid": "01a12b6d-6fa0-7658-8f88-a74f2bc5f440",
        "scanned_at": "2026-10-11T14:46:01Z",
        "final_url": "https://dexmines.io/",
        "status": 666,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://dexmines.io/",
                "from": "http://dexmines.io/",
                "status": 307
            }
        ],
        "ip": "104.21.39.16",
        "ips": [
            "104.21.39.16"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "c396babd7f49262f18a3a2ec34542c8e314cb4d869875152bb9675a6bb6066ea",
        "script_hashes": [
            "48b8a8b9dcfc0c8b438d1d761d4bb359089775b156ca9a6800b49d9368660523"
        ],
        "globals": [
            "a",
            "b",
            "e",
            "f",
            "g",
            "h",
            "cs-hashes",
            "_",
            "ee",
            "vf"
        ],
        "cookies": [
            "cs-uuid",
            "cs-back"
        ],
        "tls": {
            "san": [
                "dexmines.io",
                "*.dexmines.io"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "dexmines.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-13T10:23:09Z",
            "valid_from": "2026-08-15T09:24:39Z"
        },
        "domain_age_days": 56,
        "apex_age_days": 56,
        "tls_age_days": 57,
        "tls_valid_days": 90,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:43:37Z",
        "uuid": "0ef24c65-3447-452c-8ad5-0e7f685047c1",
        "scanned_at": "2026-10-12T09:15:51Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:30:01Z",
        "analysis_at": "2026-10-16T22:03:12Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 4,
            "suspicious": 3,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-08-15T10:11:07Z",
        "expires": "2027-08-15T10:11:07Z",
        "updated": "2026-08-20T10:11:47Z",
        "first_seen": "2026-08-15T10:54:58Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.39.16"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kiki.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "luke.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "kiki.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.142.31"
            }
        ],
        "dns_at": "2026-10-16T22:04:47Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "dexmines.io",
                "*.dexmines.io"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "39ce706ac5d0a95e13a1e3a7c444b15a",
            "sha256": "1abea22d53870959a1bc774a6bbe6f5ff0e051867339bb8be8a5a1491a4e87c5",
            "subject": "dexmines.io",
            "valid_to": "2027-01-11T11:15:45Z",
            "valid_from": "2026-10-13T10:18:18Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "http://www.nicenic.net",
            "created": "2026-08-14T16:00:00Z",
            "updated": "2026-08-14T16:00:00Z",
            "expires": "2027-08-14T16:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "kiki.ns.cloudflare.com",
                "luke.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-14T16:00:00Z",
                "registration": "2026-08-14T16:00:00Z",
                "registrar expiration": "2027-08-14T16:00:00Z",
                "last update of RDAP database": "2026-08-14T16:00:00Z"
            }
        }
    }
}
```