purpsdex[.]com

Analysis of the domain purpsdex.com indicates active phishing infrastructure targeting cryptocurrency users. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to 188.114.96.3, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. The site presents itself as a decentralized exchange (DEX) with the page title 'PURPS DEX - DEX Solution Trade Perpetuals Effortlessly on Purps,' suggesting an attempt to deceive users into believing it is a legitimate trading platform. The domain is served via Cloudflare with HTTP/3 support and uses an SSL certificate issued by Google Trust Services (WE1), which does not inherently indicate malicious intent but is consistent with phishing sites leveraging reputable infrastructure to evade detection.

As of July 23, 2026, the domain appears on one security blocklist and is flagged by 2 of 93 security vendors on VirusTotal, classifying it as a social media phishing threat. The HTTP status code 200 confirms the site is accessible, and its nameservers (greg.ns.cloudflare.com, suzanne.ns.cloudflare.com) further link it to Cloudflare's network. No evidence of a known phishing kit or specific brand impersonation beyond the page title is present in the available data. The exact content and functionality of the site remain unanalyzed, but the combination of a crypto-themed page title, recent registration, and minimal detection coverage suggests a targeted campaign.

Defenders should treat this domain as high-risk and prioritize blocking it at the network level. Monitoring for connections to 188.114.96.3 or requests to purpsdex.com in proxy logs may identify compromised endpoints. Given the domain's use of Cloudflare, additional scrutiny of other domains resolving to the same IP or sharing nameservers is recommended. If internal telemetry confirms user interaction with this domain, credential resets and account audits should be initiated for affected users.