dexit[.]top

On 28 September 2025 the domain dexit.top was registered through NiceNIC International Group Co., Limited. The authoritative name servers coen.ns.cloudflare.com and tia.ns.cloudflare.com resolve the domain to IP 209.94.90.1, an address owned by AS40680 (Protocol Labs) located in the United States. No TLS certificate is presented; HTTP connections are served without encryption. The site’s HTML title reads “REWARD Portal v2 | Latest Web3 Wallets”, indicating a wallet‑related lure.

Analysis of the page content classifies the operation as a wallet/seed phishing campaign that impersonates the Trust Wallet brand. VirusTotal reports three of ninety‑five scanning engines flagging the domain, confirming malicious intent. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. The domain’s status is listed as offline as of the report date, July 24 2026, but the infrastructure remains observable.

Evidence gaps include the lack of a live HTTP response, which prevents verification of the exact phishing payload, and the absence of additional threat‑intel feeds such as OTX or Safe Browsing references. Defenders should continue to block the IP 209.94.90.1 and the domain dexit.top at perimeter and DNS layers, monitor for any resurgence of the domain or related sub‑domains, and update endpoint detection rules with the observed page title and the three VirusTotal detections. Because the registrar is a known bulk‑registration service, future domains may be created with similar naming patterns; proactive domain‑watchlist creation for “dexit.*” and related Cloudflare name‑server configurations is advisable. Continuous re‑scanning of the domain, even while offline, is recommended to capture any changes in hosting or payload that could affect detection signatures.