dexrsceener[.]com

Analysis of dexrsceener.com indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure, as evidenced by the authoritative nameservers audrey.ns.cloudflare.com and augustus.ns.cloudflare.com. The only observable attribute is the page title "www.www.dexrsceener.com"; no additional content has been captured, and the site is currently taken offline, which limits direct inspection of payloads or credential‑harvesting mechanisms. Security telemetry shows that the domain appears on a single public phishing blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans report that two of ninety‑five anti‑virus engines flagged the domain, confirming that at least a minority of detection products have identified malicious characteristics.

The limited number of detections suggests either a low‑profile campaign or that the payload was not active at the time of scanning. Because the page content was not retrieved before the shutdown, analysts lack concrete indicators such as form fields, URLs, or malicious scripts; should the domain reappear, a fresh capture of HTTP responses and TLS certificates is required to enrich the indicator set. Given the recent registration date, the use of Cloudflare’s generic nameservers, and the presence on a phishing blocklist, the domain aligns with typical infrastructure patterns employed in short‑lived phishing operations.

Defenders should ensure that the domain is included in outbound filtering rules and that any existing DNS or URL filtering solutions are updated to block dexrsceener.com. Continuous monitoring of the associated IP ranges and the Cloudflare nameserver set is recommended, as the attacker may repoint the domain to new hosting locations after the current takedown.