app[.]dexsrceener[.]run

This domain, app.dexsrceener.run, is currently offline but exhibits several indicators consistent with a phishing infrastructure. The site was hosted behind Cloudflare, Inc., as reflected by the registrar information, and resolves to the IP address 188.114.97.3, which belongs to AS13335 (Cloudflare) and is geolocated in the United States. No TLS certificate is presented, confirming the absence of HTTPS protection. The page title returned by the server is “www.www.app.dexsrceener.run”, which offers no legitimate branding or content clues.

Threat intelligence sources have added the domain to at least one public blocklist, and PhishDestroy explicitly lists it as blocked. On VirusTotal the domain received detections from ten of ninety‑five scanning engines, indicating a moderate level of consensus among malware and URL analysis tools that the host is malicious. The Gridinsoft trust score of zero further corroborates the low reputation of the associated IP address. Because the domain is registered through Cloudflare, attribution to a specific actor is obscured, and no WHOIS details beyond the registrar are available.

The offline status prevents real‑time verification of the landing page, leaving the exact phishing payload or credential‑harvesting technique unknown. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any re‑appearance of the hostname or its IP address in outbound traffic. Additional investigation may be warranted if the domain reactivates, at which point a full content scrape and sandbox analysis should be performed to identify any credential‑stealing forms or malicious redirects.