standx.network
“Perps-Alpha | StandX Perps - Yield-Earning $DUSD Margin Trading”
Evidence Summary
This domain, standx.network, is identified as a brand_impersonation phishing campaign specifically targeting Discord users. Analysis of the page title, 'Perps-Alpha | StandX Perps - Yield-Earning $DUSD Margin Trading,' indicates an attempt to mimic legitimate decentralized finance (DeFi) trading platforms, likely to harvest user credentials, private keys, or other sensitive financial information. The domain impersonates Discord, a widely used communication platform, to exploit trust and familiarity among cryptocurrency and trading communities. Infrastructure analysis reveals the domain was registered through NET-USA (ASN: 400992) and resolves to the IP address 185.245.34.139, hosted under AS400992 (ZhouyiSat Communications) in the United States. The domain is flagged by 14 out of 95 security vendors on VirusTotal, indicating elevated detection rates. It appears on two independent security blocklists and is actively blocked by multiple threat intelligence feeds. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. No specific creation date is provided, but the domain's current offline status suggests recent takedown efforts. As of the latest assessment, standx.network has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure associated with this campaign, including the IP address and registrar, may remain active and could be repurposed for future phishing operations. Users who interacted with this domain are advised to revoke any connected wallet permissions, reset credentials, and monitor accounts for unauthorized activity. Organizations should update blocklists to include the domain and IP address to prevent residual access attempts. The elevated risk level persists due to the domain's prior activity and the potential for related infrastructure reuse.
Financial Infrastructure
Addresses extracted from the phishing page.
Telegram
Detection timeline
-
VirusTotal
15 → 16 (+1) (Added: Forcepoint ThreatSeeker)
-
Cloudflare Radar
Cloudflare Radar scan stored · Open scan
-
VirusTotal
14 → 15 (+1) (Added: ThreatHive)
Threat Response Pipeline
Public Blocklist Status
Blocklist coverage
11 monitored external feeds · stored snapshot Sep 12, 2026
10 monitored external feeds No match
Stored Capture · 2 sources
Domain Intelligence
Technical detailsDNS, SSL SANs, timestamps
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
VirusTotal Analysis · stored analysis
Archived Evidence
Community reports
Reported by 1 community member, first seen Nov 17, 2025
- Stored reports
- 1
- Unique reported URLs
- 1
Evidence & External Reports
Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive