dexobyte[.]com

Dexobyte.com has been identified as a high-risk phishing domain designed to impersonate a legitimate AI-powered trading platform. The site, titled 'Dexobyte | Platforma pro obchodování s podporou AI – Oficiální stránky,' is a classic example of brand impersonation aimed at cryptocurrency traders. The threat type is generic phishing, but the page specifically attempts to harvest credentials or lure victims into connecting their crypto wallets, effectively acting as a crypto drainer. The domain was created on March 01, 2026, and registered through NETIM SAS, a French registrar.

Technical analysis reveals several alarming indicators. VirusTotal reports that 12 out of 95 security vendors flag this domain as malicious, and Google Safe Browsing lists it as a phishing threat. The domain resolves to IP address 172.245.112.196 and uses an SSL certificate issued by Let's Encrypt with fingerprint E8, which is commonly abused by malicious sites. Additionally, the domain appears on three security blocklists, further confirming its dangerous nature. The site is currently offline, but its recent creation and rapid flagging suggest it was used in a targeted campaign.

Given that the domain is now offline, the immediate risk of interaction is low, but users who may have visited the site before takedown should be vigilant. PhishDestroy recommends that anyone who entered credentials or connected a wallet on dexobyte.com should immediately change their passwords and revoke any token approvals. The domain's registration details and IP should be monitored for future malicious activity, as threat actors often reuse infrastructure. Users are advised to always verify the legitimacy of trading platforms and avoid clicking on unsolicited links.