dphrase[.]net

The domain dphrase.net was registered on 3 November 2024 through NameSilo, LLC and is currently resolved to the IP address 102.218.215.124, which belongs to AS329184 Host Africa (Pty) Ltd in South Africa. The authoritative nameservers are dan1.host-ww.net and dan2.host-ww.net. No TLS certificate is presented for the site, indicating that connections were served over plain HTTP. The page title observed during the brief online presence was “Phraser | Crypto Wallet Earning”, and the associated scam type is listed as a crypto scam.

VirusTotal analysis shows that seven of ninety‑five scanners flagged the domain, reflecting a moderate detection rate. The domain appears on four public blocklists and has been explicitly blocked by the security services PhishDestroy, Polkadot, Enkrypt, and Codeesura. Reputation services assign low confidence scores, with Gridinsoft rating the site at 38 / 100 and Scamadviser at 41 / 100. AlienVault OTX references the domain in a single threat‑intel pulse.

As of the report date, the site is taken offline, limiting direct observation, but the historical indicators suggest an infrastructure designed to lure victims into depositing cryptocurrency, likely through a counterfeit wallet interface. Uncertainty remains regarding the exact phishing kit or the specific cryptocurrency addresses used, as no payload samples or page screenshots were captured. Defenders should continue to block the domain and the associated IP address at perimeter and DNS layers, monitor for re‑hosting attempts on other infrastructure, and consider adding the observed nameservers to watchlists for possible reuse. Ongoing intelligence collection should target any revived TLS certificates or changes in hosting that could indicate a resurgence of the campaign.