coredex[.]space

On 22 July 2026, coredex.space was identified as an active generic‑phishing infrastructure with a high risk rating. The domain was created on 25 June 2026 and resolves to the IPv4 address 88.222.222.156, which is allocated to Hostinger International Ltd. in Lithuania. Hosting metadata shows the site is served through Hostinger’s CDN and advertises HTTP/3 support, but it lacks an SSL/TLS certificate, meaning all traffic is unencrypted. The authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, both typical of parked or rapidly provisioned domains.

The page title returned by the web server is "The Decentralized Protocol", a generic phrase that offers no indication of legitimate purpose. The domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—each of which classifies it as malicious. VirusTotal records show the site has been scanned by 91 antivirus engines without a detection, but the absence of a detection does not imply safety, especially given the blocklist presence and phishing classification. The registrar information lists HOSTINGER operations, UAB as the registering entity, consistent with the hosting provider.

No additional indicators such as known malware kits, brand impersonation, or specific phishing pages have been publicly disclosed. Given the combination of a newly registered domain, lack of encryption, placement on multiple blocklists, and the generic page title, defenders should treat coredex.space as hostile. Recommended mitigations include adding the domain to network deny lists, monitoring DNS queries for the associated IP and name servers, and employing web-filtering solutions that reference the listed blocklists. Continuous re‑evaluation is advised in case new payloads or credential‑stealing pages appear.