app-dexsnetwork[.]com

This investigation documents app-dexsnetwork.com, a domain created on 21 February 2026 via Cosmotown, Inc. The authoritative name servers alina.ns.cloudflare.com and ignacio.ns.cloudflare.com resolve the name to 104.21.80.110, an address owned by AS13335 Cloudflare, Inc. in the United States. The site presented the page title “Suspected phishing site | Cloudflare” and served an SSL certificate issued by Google Trust Services under the WE1 certificate profile, confirming HTTPS termination at the edge of Cloudflare’s network. Automated analysis by Gridinsoft assigned a trust score of 0 / 100, indicating extreme risk. VirusTotal recorded 13 of 93 security‑vendor engines flagging the domain as malicious, and four independent blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura) already block the address.

Additional fingerprinting shows the use of Cloudflare’s HTTP/3 protocol, consistent with the hosted infrastructure. The evidence confirms that the domain is being leveraged for a generic phishing operation, yet the specific payload, target brand, or credential‑capture mechanism has not been disclosed in the available artifacts. No further page content or HTTP response details have been published, leaving the exact technique and victim profile uncertain. The high risk rating reflects the combination of a fresh registration, zero trust score, multiple vendor detections, and active blocklist listings.

Defenders should immediately add app-dexsnetwork.com to network‑level deny lists and update endpoint protection signatures to include the observed indicators. Continuous monitoring of the associated IP range (104.21.80.0/24) and Cloudflare‑hosted domains is advised, as the attacker may pivot to additional hosts. Although the site is currently offline, the infrastructure components remain active and could be re‑used, so threat‑intel feeds should retain the domain for correlation with future phishing campaigns.