dexintegrations[.]netlify[.]app

The domain dexintegrations.netlify.app has been identified as a crypto wallet drainer, a specific type of phishing threat designed to siphon cryptocurrency assets from victims by impersonating legitimate wallet interfaces. Analysis indicates the domain is currently offline, though it previously exhibited active malicious behavior targeting users of decentralized finance (DeFi) platforms. No direct brand impersonation has been confirmed, but the infrastructure aligns with common tactics used in wallet-draining attacks. Infrastructure analysis reveals the domain was flagged by 14 of 95 security vendors on VirusTotal, indicating broad detection despite its recent takedown. It was registered through Netlify, a platform commonly abused for hosting malicious content due to its free and low-friction deployment capabilities. The domain resolved to the IPv6 address 2a05:d014:58f:6200::259, geolocated in Germany under Amazon.com, Inc. (AS16509). It appears on four security blocklists, including PhishDestroy and Polkadot, and was explicitly blocked by wallet extensions such as Enkrypt and Codeesura. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides no inherent trust, as certificates are routinely issued for malicious domains. Google Safe Browsing also classified this domain as phishing prior to its removal. Current status confirms the domain is offline, with the page title displaying 'Site not found.' However, the risk level remains high due to the domain's prior activity and the potential for re-emergence under similar infrastructure. Organizations and individuals are advised to block the domain and its associated IP address at the network perimeter. Users should verify wallet addresses and transaction details independently before execution, particularly when interacting with links from untrusted sources. Monitoring for related domains registered through Netlify or resolving to the same IP range is recommended, as threat actors often reuse infrastructure. If financial loss occurred, affected parties should report the incident to relevant law enforcement and blockchain analytics services for further investigation.