dexscreener-v3[.]com

PhishDestroy identifies dexscreener-v3.com as a crypto drainer domain impersonating the legitimate DexScreener platform, hosting a fraudulent interface designed to steal cryptocurrency assets from unsuspecting users. The domain employs a near-exact visual replication of DexScreener’s branding and UI to deceive victims into connecting their wallets under the guise of token analytics or trading tools. This tactic aligns with the growing trend of crypto drainer kits that automate fund extraction upon wallet connection, leveraging social engineering to bypass technical safeguards. The fake site is likely distributing drainer scripts via obfuscated JavaScript payloads embedded in the landing page, which trigger malicious transaction approval dialogs or token transfer requests once a wallet is connected.

This domain resolves to IP address 216.150.1.193 and is registered through OwnRegistrar, Inc., with a creation date of April 09, 2026. The site holds a valid Let’s Encrypt SSL certificate, which is commonly used by threat actors to establish trust. As of the latest scan, dexscreener-v3.com has 0 detections out of 95 engines on VirusTotal, indicating it currently evades most signature-based detection systems. It has not been flagged by Google Safe Browsing (GSB) and remains unlisted on major threat intelligence blocklists, suggesting a recent deployment or low global exposure. Despite the lack of detection, the domain’s recent registration and aggressive impersonation strategy signal high malicious intent and operational immediacy.

The domain is currently active and under active monitoring by PhishDestroy. Security researchers are conducting reverse engineering on the site’s backend scripts and wallet connection logic to extract IOCs including drainer wallet addresses and C2 endpoints. Users are strongly advised to avoid visiting dexscreener-v3.com and to verify any DexScreener-related links through official channels such as the verified DexScreener website or trusted social media accounts. Until further analysis confirms mitigation, this domain remains high-risk due to its potential to facilitate irreversible cryptocurrency theft. Blocking the domain at the network level and updating endpoint protections with newly derived IOCs is recommended to prevent user exposure.