dexcreeners-voting[.]com

PhishDestroy identifies www.dexcreeners-voting.com as an active credential harvesting domain under investigation for phishing. This domain poses a HIGH RISK due to its direct mimicry of the legitimate DexScreener platform, targeting users seeking crypto analytics tools. Upon interaction, the site likely prompts users to input sensitive credentials or cryptocurrency wallet details, which are then harvested by attackers for financial theft or identity fraud. Immediate avoidance is strongly advised.

This domain was flagged by PhishDestroy with the following technical indicators: It resolves to IP address 216.150.1.1, registered through Name.com, Inc., and was created on April 25, 2026. The SSL certificate is issued by Let's Encrypt, which does not inherently indicate trustworthiness for newly registered domains. VirusTotal currently shows 0/95 detections, suggesting it has not yet been widely flagged by security vendors, and no blocklist entries or trust scores are publicly available at this time. The absence of detections is particularly concerning, as it indicates the domain may be in the early stages of deployment, evading initial detection mechanisms. The domain name closely resembles 'DexScreener,' a legitimate crypto analytics platform, leveraging typosquatting to deceive users.

To mitigate risks associated with this credential harvesting domain, users must avoid clicking any links to www.dexreeners-voting.com or entering sensitive information. Verify the legitimacy of any crypto-related website by cross-referencing official sources and ensuring the URL matches the correct domain (e.g., dexscreeners.com). Use browser extensions that detect phishing or credential harvesting attempts, such as uBlock Origin or Bitdefender TrafficLight. Report this domain to your security team or via platforms like PhishDestroy, VirusTotal, or Google Safe Browsing to contribute to collective threat intelligence. If you have already interacted with this site, immediately change passwords for any accounts exposed, revoke API keys or wallet permissions, and monitor financial accounts for unauthorized activity. Organizations should consider blocking this IP (216.150.1.1) and domain at the network level to prevent further exposure. Proactive threat hunting and user education on recognizing typosquatting and phishing tactics are critical to reducing the risk of credential compromise.