dexautomate[.]web[.]app

Analysis indicates that dexautomate.web.app resolves to the Fastly edge address 199.36.158.100, located in the United States and announced under ASN 54113 (Fastly, Inc.). The site presents the page title “Dex Automate | Simple and secure interface that integrates seamlessly with your …”, but the HTTP response returned a 404 status at the time of inspection, suggesting the content has been removed or the host is no longer serving the page. The TLS certificate is issued by Google Trust Services under the WR4 profile, confirming that the domain is hosted on Google infrastructure and was registered through Google LLC. Reputation services assign a Scamadviser trust score of 1 out of 100, reflecting extreme untrustworthiness. The domain is classified as an investment‑scam type according to the supplied intelligence, and it has been listed on three public blocklists (PhishDestroy, ScamSniffer, Enkrypt) as well as on three additional security blocklists referenced in the intelligence feed.

VirusTotal scans show nine of ninety‑five scanners flag the domain as malicious, reinforcing the suspicion. Detected technologies include Firebase hosting, enforced HSTS, and support for HTTP/3, all typical of modern web delivery platforms but not indicative of benign intent. No nameserver information is available, and no further payload or credential‑collection pages have been captured.

Because the site is currently offline, immediate mitigation focuses on ensuring that network‑level defenses continue to block the hostname and its associated IP address, updating URL filtering rules, and monitoring Fastly‑origin traffic for potential re‑use of the same IP range. Analysts should also verify that any internal users who may have previously accessed the domain are instructed to change compromised credentials and to report any suspicious activity. The lack of live content prevents confirmation of the exact phishing flow, so further observation is recommended in case the domain reactivates.