dexnodetools[.]web[.]app

The domain dexnodetools.web.app is currently listed as offline and was taken down after being identified as part of an investment‑scam phishing campaign. The site used a page title “Dex Tools – Simple and secure interface that integrates seamlessly with your browser”, which suggests an attempt to impersonate a legitimate decentralized‑exchange utility. HTTP probing returned a 404 status, indicating that the content is no longer publicly reachable. The domain is registered through Google LLC, and its DNS configuration shows no publicly visible nameservers. Infrastructure analysis shows that the hostname resolves to IP 199.36.158.100, an address owned by Fastly (ASN 54113) located in the United States.

The server presents a TLS certificate issued by Google Trust Services under the WR4 profile, and the connection enforces HSTS and HTTP/3, typical of modern cloud‑hosted services. Technology fingerprinting identified Firebase as the backend platform, further confirming the use of Google‑managed hosting. Reputation signals include a Gridinsoft trust score of 35 out of 100 and inclusion on a single security blocklist. The domain appears on PhishDestroy's blocklist, which explicitly tags it as an investment‑scam vector. VirusTotal records indicate that 95 scanning engines have examined the site and none have raised a detection, but this absence of flags does not constitute verification of safety given the domain's removal from service and its classification by other sources.

Uncertainty remains around the exact content that was served before takedown, as no page capture is available and the HTTP status is now 404. Additionally, the lack of nameserver information limits deeper DNS‑level attribution. Defenders should continue to block the domain at perimeter and DNS filters, monitor Fastly‑hosted IP ranges for similar phishing constructs, and treat any emails or messages referencing “Dex Tools” as suspicious.