dexweb-defi[.]vip

Analysis of dexweb-defi.vip indicates that the domain was registered on May 30 2025 through Dynadot LLC and subsequently used in a crypto‑drainer campaign. The domain resolves to 172.67.146.34, an address owned by Cloudflare (AS13335) located in the United States. Both clyde.ns.cloudflare.com and paloma.ns.cloudflare.com are listed as authoritative name servers, confirming the Cloudflare front‑end. The site presented a 404 Not Found page title at the time of capture, and its SSL certificate was issued by Google Trust Services under the WE1 root, demonstrating a valid TLS chain. Detection services flagged the domain: 15 of 93 vendors on VirusTotal reported it as malicious, two independent blocklists listed it, and Google Safe Browsing classified it as social engineering.

Additional security products PhishDestroy and ScamSniffer have also blocked the domain. The Gridinsoft trust score of 0/100 reflects an extremely low reputation. The observed technology stack includes Cloudflare services and HTTP/3 support, which can be leveraged to obfuscate traffic. The current status is offline, which may be temporary or a takedown.

While the available data confirms the domain’s involvement in a crypto‑drainer operation, no further details about the specific payload, victim interaction flow, or associated cryptocurrency addresses have been uncovered. Defenders should continue to monitor the IP 172.67.146.34 for any resurgence of malicious activity, enforce deny‑list rules for the domain and its IP in web filtering solutions, and propagate the detection indicators to threat‑intel sharing platforms. Network sensors should be tuned to alert on TLS connections to the Google Trust Services‑issued certificate presented by this domain, and any outbound requests to the Cloudflare edge nodes should be inspected for anomalous patterns consistent with crypto‑drainer traffic.