dexscreneer[.]github[.]io

The domain dexscreneer.github.io was registered on February 21, 2026 through MarkMonitor, Inc. and hosted on GitHub Pages fronted by Fastly’s edge network. Infrastructure analysis shows the site resolves to the IPv6 address 2606:50c0:8003::153, which is announced by AS54113 Fastly, Inc. in the United States. HTTP probing returned a 404 status, indicating the resource is no longer publicly reachable, and the site is currently listed as taken offline. TLS inspection reveals a Let’s Encrypt R12 certificate, confirming the use of a free, automated certificate authority.

Detected web‑stack components include Varnish caching and Fastly CDN, consistent with the hosting profile of GitHub Pages. Google Safe Browsing classifies the domain as a social engineering threat, and the site appears on a single external blocklist, specifically PhishDestroy. VirusTotal analysis recorded 12 positive detections out of 93 scanned security vendors, reinforcing the malicious assessment. The page title returned from the host – “DEX Screener – Track your DEX Analytics” – directly mirrors the legitimate DEX Screener brand, suggesting the domain was intended to impersonate that service for phishing or credential‑harvesting purposes.

Concrete evidence beyond the title and detection signals is unavailable because the site is offline; therefore the exact payload, phishing landing page, or credential capture mechanism cannot be confirmed. Defenders should immediately block DNS resolution to dexscreneer.github.io and add the domain to web‑filter and email‑gateway deny lists. Continuous monitoring of Fastly‑served IPv6 ranges and GitHub Pages subdomains for similar naming patterns is advised, as threat actors often reuse the same infrastructure for new campaigns. Organizations that rely on DEX Screener should inform users of the impersonation attempt and reinforce security awareness training to recognize unsolicited URLs that mimic legitimate analytics services.