fluid-dex[.]org

The domain fluid-dex.org was registered on April 14, 2026 through GoDaddy.com, LLC and resolves to the IP address 186.2.175.35, which is assigned to AS59692 IQWeb FZ-LLC in Russia. The authoritative nameservers are ns29.domaincontrol.com and ns30.domaincontrol.com, both typical of GoDaddy’s DNS infrastructure. The site presented a TLS certificate issued by Let’s Encrypt (R12), indicating that HTTPS was available at the time of observation. The page title returned by the server reads “Fluid DEX — The Unified DeFi Liquidity Layer,” suggesting an attempt to portray a decentralized finance service.

Automated analysis on VirusTotal recorded 16 detections out of 91 security vendors, and the domain appears on three public blocklists. Additional blocking services—PhishDestroy, MetaMask, and SEAL—have explicitly listed the domain as malicious. A Gridinsoft trust score of 0 / 100 further reflects a high‑confidence negative assessment. Scanning tools identified the presence of Modernizr and DDoS‑Guard, the latter often used to obscure traffic patterns.

The overall risk rating assigned is high, and the current operational status is offline, indicating that the malicious infrastructure may have been taken down or is temporarily unavailable. While the available evidence confirms that fluid-dex.org is associated with phishing‑related activity, the exact content of the site (e.g., login forms or credential‑harvesting pages) has not been captured, leaving the precise attack vector uncertain. Defenders should continue to block the domain at network perimeters, update proxy and DNS filtering policies, and monitor the associated IP range for any re‑activation. Threat‑intel platforms should record the registration details, hosting ASN, and the observed detections to aid future attribution and correlation with other campaigns targeting DeFi users.