dexvoting[.]live

On July 25, 2026 analysts observed that dexvoting.live resolves to the Cloudflare edge address 104.21.55.57, which is associated with ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The domain is delegated to the Cloudflare name servers dane.ns.cloudflare.com and nena.ns.cloudflare.com, indicating that the registrar used was Cloudflare, Inc. No TLS certificate was presented during connection attempts, confirming that the site operated without HTTPS protection. The only visible metadata is the page title “Dex Screener,” which does not correspond to the advertised banking‑phishing campaign and therefore provides limited insight into the payload.

Threat‑intel feeds list the site as a banking phishing case; it has been added to a single security blocklist and was actively blocked by the PhishDestroy service. VirusTotal scans show that 2 out of 95 antivirus engines flagged the domain, while the Gridinsoft trust score assigns a rating of 0 / 100, reflecting a high confidence in malicious intent. The site’s current status is marked as taken offline, which suggests that the operators may have ceased activity or are temporarily withdrawing the infrastructure.

Despite the offline state, the observable infrastructure—Cloudflare hosting, lack of TLS, low trust score, and detection by multiple security vendors—remains indicative of a credential‑harvesting operation. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP address, and consider adding the domain and its IP to threat‑intel feeds. Ongoing observation is recommended to detect any potential re‑activation or migration to alternative hosting services.