psyopanime[.]app

Analysis of the domain psyopanime.app, observed on July 22 2026, indicates an active wallet/seed phishing campaign that masquerades as the cryptocurrency analytics platform DexScreener. The site returned HTTP 403 responses, suggesting that the content is intentionally hidden or access‑restricted, and it was served over Cloudflare’s network (ASN 13335) using HTTP/3. DNS resolution points to IP 104.21.85.9, a Cloudflare edge address located in the United States. The TLS certificate is issued by Let’s Encrypt (CN = E8), confirming the use of a free, automated certificate.

VirusTotal scans flagged the domain on three of ninety‑five antivirus engines, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The WHOIS record shows registration through NiceNIC International Group Co., Limited on February 22 2026, and the authoritative nameservers are kinsley.ns.cloudflare.com and tim.ns.cloudflare.com. The domain is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a malicious resource. The only visible page element is the title tag “$PSYOPANIME”, which does not reference DexScreener and may be used to lure victims familiar with the brand’s token or wallet terminology.

No public samples of the landing page content have been captured, and the exact phishing flow remains unverified. Defenders should add psyopanime.app to deny‑list rules for DNS, web proxy, and email filters, monitor for connections to 104.21.85.9, and enforce TLS inspection to detect any credential exfiltration attempts. Users of DexScreener should be reminded not to enter wallet seeds on any site other than the official domain, and blockchain wallet extensions such as MetaMask should continue to block interactions with this host.