dexscreener-vote[.]live

Analysis of dexscreener-vote.live indicates an active phishing infrastructure that was taken offline as of the report date. The domain was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and lacks an SSL certificate, meaning it served content only over HTTP. DNS resolution points to the IP address 216.198.79.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain uses Cloudflare nameservers gordon.ns.cloudflare.com and surina.ns.cloudflare.com, suggesting the attacker leveraged Cloudflare’s DNS service for resilience.

The page title returned by the server is “DEX Screener | Community Voting,” indicating an attempt to masquerade as a community voting feature for the DEX Screener platform. VirusTotal scanning recorded a single positive detection out of 95 security vendors, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. These blocklist entries confirm that multiple security products have identified the domain as malicious.

The current offline status prevents immediate interaction, but the infrastructure components—registration details, hosting on a major cloud provider, and use of reputable DNS resolvers—remain observable and could be repurposed. Defenders should continue to block the domain and its associated IP address at network perimeters, monitor for re‑registration attempts, and add the domain to internal threat intelligence feeds. Additional investigation of the underlying page content, HTTP response headers, and any associated URLs would be necessary to fully map the phishing campaign’s objectives and potential victim surface.