dexrp-update[.]live

The domain dexrp-update.live was registered on April 02, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is hosted on Cloudflare infrastructure, resolving to the IP address 104.21.94.184, which is associated with Cloudflare, Inc. in Canada. DNS resolution is delegated to edward.ns.cloudflare.com and delilah.ns.cloudflare.com. The site presents a valid Let's Encrypt certificate (E7) that enables HTTPS connections.

Security scanners categorize the domain as a high‑risk credential‑phishing operation with a crypto‑scam focus. VirusTotal records 13 detections out of 95 scanned vendors, and the Gridinsoft trust score is 0 out of 100, indicating a strong malicious profile. The domain appears on a single public blocklist and is actively blocked by PhishDestroy. AlienVault OTX lists the domain in one threat‑intel pulse, reinforcing its malicious reputation.

Web requests to the host return HTTP 403 responses, preventing direct observation of the phishing landing page. Consequently, the exact content and credential‑harvesting mechanisms remain unverified, and the specific cryptocurrency lure cannot be confirmed from the current data set. The absence of visible payloads limits attribution of any particular phishing kit or exploitation technique.

Defenders should immediately block traffic to dexrp-update.live and its associated IP 104.21.94.184 at network perimeters and DNS resolvers. Continuous monitoring of Cloudflare edge nodes for anomalous request patterns is advised, as the infrastructure could be reused for additional phishing sites. Updating endpoint detection rules to flag TLS connections presenting a Let's Encrypt/E7 certificate to this domain will aid in early detection. Ongoing intelligence collection is recommended to capture any future content changes or campaign expansions.