dex-fluid[.]net

Analysis of dex-fluid.net indicates a recently registered domain exhibiting characteristics consistent with phishing infrastructure. The domain was created on July 31, 2026, and remains active as of August 05, 2026. It is currently flagged on one security blocklist, PhishDestroy, though no detections are recorded among the 91 vendors that have scanned it on VirusTotal. The absence of detections does not confirm safety, as phishing domains often evade initial scans through rapid deployment or obfuscation techniques. Infrastructure analysis reveals the domain is hosted behind Cloudflare, resolving to the IP address 104.21.49.168.

Nameservers elijah.ns.cloudflare.com and teagan.ns.cloudflare.com further confirm Cloudflare’s role in its hosting and DNS management. Cloudflare’s services are frequently leveraged by threat actors to obscure malicious infrastructure, complicating takedown efforts and delaying detection. The registrar, Fewmoretaps OU operating under Trustname.com, has been associated with other high-risk domains, though no direct evidence links this registrar to malicious intent in this specific case. No brand, scam type, or page content has been confirmed in available intelligence. The domain’s exact purpose remains unclear, as no HTTP status, SSL anomalies, or page title data is currently available.

Defenders should treat this domain as suspicious based on its recent registration, Cloudflare hosting, and blocklist presence. Monitoring for additional detections, behavioral analysis of traffic patterns, and reviewing logs for connections to 104.21.49.168 are recommended. If the domain is encountered in enterprise environments, it should be blocked pending further investigation, particularly given its inclusion on PhishDestroy’s blocklist. Further analysis, including sandboxed inspection of the site, is advised to determine its specific threat profile.