dextoken[.]cc

Analysis of dextoken.cc shows multiple indicators of malicious intent consistent with a generic phishing operation. The domain was registered on May 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. Its authoritative nameservers are ainsley.ns.cloudflare.com and khalid.ns.cloudflare.com, both belonging to Cloudflare’s DNS service, which is frequently used by threat actors to obscure hosting provenance. The domain resolves to the IPv4 address 188.114.97.3, an IP that is not publicly associated with a known corporate entity and therefore offers no legitimate reputation signal.

Google Safe Browsing has flagged the domain for social engineering, indicating that it is recognized as attempting to deceive users. In addition, the domain appears on a security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that independent anti‑phishing infrastructure has taken action against it. VirusTotal analysis shows that three out of ninety‑one scanned security vendors have reported the domain as malicious, providing further independent corroboration of its risk profile. The available intelligence does not include detailed HTTP response codes, SSL certificate details, page title, or any observed payload, leaving the exact content of the site unverified.

However, the convergence of registration recency, Cloudflare DNS, Google Safe Browsing social‑engineering flag, blocklist presence, and vendor detections collectively point to a high‑risk phishing threat. Defenders should block or sinkhole dextoken.cc at the network perimeter, update intrusion‑prevention signatures to include the domain and its resolving IP, and monitor for any outbound connections to the address 188.114.97.3. Continuous re‑evaluation is advised in case additional telemetry, such as malware payloads or victim reports, becomes available.