dexrpexplorer[.]org

On April 25, 2026, PhishDestroy flagged dexrpexplorer.org as an active phishing domain designed to mimic legitimate DeFi portfolio explorers. The site lures cryptocurrency users by masquerading as a tool for tracking transactions and wallet balances on decentralized exchanges. Once victims connect their wallets under the guise of viewing activity, the attacker silently drains funds via malicious smart contract interactions or direct wallet theft. This domain currently resolves to IP address 172.67.210.197 and operates with a valid Let’s Encrypt SSL certificate, making it appear more convincing to unsuspecting users. This domain was flagged after VirusTotal analysis returned zero detections out of 95 security engines, indicating it is not yet widely recognized as malicious. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and went live on April 25, 2026, suggesting a recent and opportunistic campaign targeting the growing DeFi user base. The lack of detections highlights the danger of relying solely on signature-based tools for protection, as new and rapidly evolving phishing domains can evade detection long enough to inflict significant damage. If you accessed dexrpexplorer.org or entered any wallet credentials, disconnect your wallet from the site immediately using your wallet’s interface or browser extension. Transfer any remaining assets to a new wallet via a hardware device or verified, offline method. Scan your device with updated antivirus software and consider revoking any suspicious token approvals using tools like revoke.cash. Report the domain to your wallet provider and relevant security platforms (e.g., PhishFort, OpenPhish) to help block future access. Always verify URLs manually and use bookmarks for frequently visited DeFi platforms to avoid typosquatting traps.