bridge-dexrp[.]org

This domain, bridge-dexrp.org, operates as a fraudulent presale portal impersonating the DeXRP decentralized trading platform. Analysis indicates the site is designed to harvest cryptocurrency wallet credentials and private keys under the guise of an exclusive token presale event, exploiting investor interest in decentralized finance (DeFi) opportunities. The page title, 'Join the DeXRP Presale – Be Part of the Future of Decentralized Trading,' directly mimics legitimate project announcements to deceive victims into connecting wallets or transferring funds to attacker-controlled addresses. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on April 2, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while it appears on four distinct security blocklists. The domain resolves to IP address 172.67.191.244, a Cloudflare proxy endpoint commonly used to obscure hosting infrastructure. Additional detection by four specialized cryptocurrency security tools further confirms its role in targeting digital asset holders. Users who interacted with bridge-dexrp.org should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet address. Monitor all linked accounts for unauthorized transactions and reset credentials for any platforms where identical passwords were reused. Report the incident to relevant blockchain security teams and local cybercrime authorities, providing transaction hashes and timestamps of interactions. Given the elevated risk level and offline status, affected parties should assume credential exposure and act under the presumption of compromise.