dafeax[.]vip

Analysis of dafeax.vip, observed as offline on 22 July 2026, indicates that the domain was used for a Binance‑related wallet/seed phishing campaign. The domain resolves to IP address 104.21.75.81, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Registration was performed through NameSilo, LLC on 10 August 2025, and the authoritative nameservers are ignat.ns.cloudflare.com and zara.ns.cloudflare.com, consistent with the Cloudflare hosting footprint. No TLS certificate was presented, confirming the absence of HTTPS protection at the time of observation. Threat intelligence sources corroborate the malicious intent.

PhishDestroy has listed the domain on its blocklist, and AlienVault OTX includes it in one pulse, reinforcing the classification as a brand‑impersonation vector targeting Binance users. VirusTotal records show that five of ninety‑five scanned security vendors flagged the domain, while the domain appears on a single security blocklist. Independent reputation services assign extremely low trust scores: Gridinsoft rates it 0 out of 100 and Scamadviser 1 out of 100, reflecting a high likelihood of fraudulent activity. The page title was not captured, leaving the exact content of the landing page unknown.

Likewise, the specific phishing kit or page layout cannot be confirmed without a live sample. Nevertheless, the convergence of registration data, hosting information, blocklist entries, and the identified scam type (wallet/seed phishing) provides sufficient evidence for defensive measures. Organizations should add the domain and its resolving IP to network‑level deny lists, monitor DNS queries for the associated nameservers, and ensure endpoint security solutions are updated to include the five vendor detections reported by VirusTotal. Continuous observation of Cloudflare‑hosted domains that resolve to the same IP may be warranted, given the platform’s frequent use by opportunistic actors.