dex-resolve[.]xyz

On 24 July 2026, the domain dex-resolve.xyz was observed pointing to the IP address 172.67.220.201, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain was registered through NiceNIC International Group Co., Limited on 6 March 2026 and uses the Cloudflare nameservers kay.ns.cloudflare.com and nitin.ns.cloudflare.com. No TLS certificate was presented during the probe, indicating the site served over plain HTTP only. The only visible artifact was the page title “Just a moment…”, which does not disclose any brand or service being impersonated. VirusTotal recorded a single positive detection out of 94 scanned security vendors, and the domain appears on one external blocklist.

PhishDestroy has also marked the domain as blocked. The threat classification supplied is “Crypto Scam”, suggesting the infrastructure is intended to lure victims into a cryptocurrency‑related fraud, although no further payload or luring page details were captured before the site was taken offline. Evidence points to a typical abuse of Cloudflare’s free tier to obscure the true location of the operator, a pattern commonly seen in low‑volume phishing and crypto‑drainer campaigns. The lack of a TLS certificate reduces the trust score of the site, while the generic page title and absence of brand references limit attribution of the exact victim‑targeted service.

Analysts cannot confirm whether the domain ever delivered malicious content, redirects, or credential‑harvesting forms because the service was unavailable at the time of analysis. Defenders should add dex-resolve.xyz to their URL filtering lists, monitor DNS queries for the domain and its associated IP, and incorporate the observed nameserver pairs into threat‑intel feeds. Given the elevated risk rating, network perimeter controls should block outbound connections to the IP address 172.67.220.201, and any internal alerts that reference the domain should be escalated for further investigation.