screenertrending[.]live

Analysis of screenertrending.live shows a newly registered domain created on March 02, 2026 that was quickly leveraged for a banking‑phishing campaign. The domain resolves to the Cloudflare edge address 104.21.26.101, which is announced by AS13335 and geolocated to the United States. No TLS certificate is presented, indicating the site was served over plain HTTP or that HTTPS was not configured at the time of observation. The authoritative nameservers are everton.ns.cloudflare.com and jo.ns.cloudflare.com, both standard Cloudflare resolvers, suggesting the attacker relied on Cloudflare’s CDN to hide the true origin.

The page title returned by the HTTP response is "Dex Screener," matching the name of a legitimate decentralized finance analytics platform, and the listed scam type is banking phishing, implying that credential‑stealing forms were likely hosted under the guise of a Dex Screener interface. The domain has been added to three public blocklists and is flagged by the PhishDestroy, MetaMask, and SEAL filtering services, confirming that security vendors have identified it as malicious. VirusTotal recorded a single positive detection out of 93 scanned engines, reinforcing the consensus that the site is abusive.

Current status is offline, indicating that the hosting has been taken down or the site is otherwise inaccessible, but the infrastructure footprint—particularly the Cloudflare IP—remains observable and could be reused. Defenders should block the domain and the associated IP at perimeter defenses, update URL filtering rules to include the observed blocklist entries, and monitor for any re‑appearance of the same IP or similar Cloudflare‑hosted subdomains. Continuous re‑scanning of the domain via VirusTotal and other sandbox services is recommended to capture any future changes in payload or hosting configuration.