v4-dex-urni[.]top

The domain v4-dex-urni.top resolves to the IP address 104.21.69.119, which is owned by Cloudflare, Inc. (AS13335) and is geolocated to the United States. Registration records indicate the domain was created on 5 December 2025 through NiceNIC International Group Co., Limited, and it is delegated to the Cloudflare authoritative nameservers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. When accessed, the site returned the generic page title "Welcome to nginx!" and served content over HTTP/3, confirming the use of Cloudflare's edge network and modern transport protocols. TLS termination is performed by a certificate issued by Google Trust Services under the WE1 label, demonstrating that encryption is terminated at the CDN rather than on an origin server.

VirusTotal scans reported three positive detections out of ninety‑five security vendors, and the domain appears on a single external blocklist. The phishing‑protection service PhishDestroy has taken the domain offline, and its current status is listed as "taken offline". The observed infrastructure matches a brand‑impersonation campaign that targets x.com, indicating an attempt to lure users into a malicious interaction with the X.com brand. No concrete evidence of the malicious payload, credential‑harvesting forms, or command‑and‑control infrastructure has been captured, and no additional domains or IPs have been linked to this campaign in public sources.

Consequently, the full operational scope and the exact technique used to deceive victims remain uncertain. Defensive recommendations include configuring network and web filters to block any HTTP(S) requests to v4-dex-urni.top and to the underlying IP 104.21.69.119, especially when the hostname appears in outbound traffic from internal users.