dexoraen[.]digital

The phishing domain dexoraen.digital was created on February 22, 2026, and is associated with credential theft activities. The page title "Vignette Österreich - Dexoraen Digital" suggests a potential targeting of Austrian services, possibly impersonating a legitimate entity to harvest user credentials. No specific drainer kit is associated with this domain, but the intent to capture sensitive information is evident given the context and structure of the site.

Technical analysis reveals several concerning indicators. The domain resolves to the IP address 104.21.52.72 and utilizes technologies such as Cloudflare and HTTP/3, indicating an attempt to leverage reliable infrastructure for phishing activities. VirusTotal results show 8 out of 95 security vendors have flagged this domain, reflecting its malicious nature. Registered through Dynadot LLC, the domain was operationally active until its recent takedown. The site used an SSL certificate issued by Google Trust Services, which may have lent an appearance of legitimacy. Currently, the domain appears on one security blocklist and has been blocked by PhishDestroy, with a Gridinsoft trust score of 0 out of 100, underscoring its lack of trustworthiness.

As of the latest update, dexoraen.digital is offline, mitigating immediate risks to potential victims. However, the presence on blocklists and the VirusTotal detection rate suggest potential lingering threats should the domain become active again or similar domains emerge. It is crucial for cybersecurity teams to monitor for similar impersonation attempts, apply robust email filtering, and educate users about recognizing phishing emails and fraudulent websites. Continuous monitoring of DNS registrations for related domain patterns may provide early warning of new threats.