derouter[.]xyz

PhishDestroy first observed derouter.xyz on Feb 13, 2026. Multiple third-party sources reported positive findings for this domain. Evidence score: 91/100; this is a triage score, not a probability.

VirusTotal recorded 12 detections among 93 engines on Apr 23, 2026 at 02:29 UTC. Spamhaus DBL: DBL_PHISH on Jul 14, 2026 at 10:33 UTC. The same snapshot provides additional context. AlienVault OTX listed 1 community pulse reference (not vendor detections) on Mar 1, 2026 at 09:10 UTC. The external blocklist snapshot contained no matches on Aug 7, 2026 at 06:20 UTC. These additional observations do not override the positive findings or guarantee safety.

The latest probe returned HTTP 502 on Aug 7, 2026 at 01:34 UTC, so content was unavailable at the checked location. This does not establish the cause. Registration records list NiceNIC International Group Co., Limited as the registrar and Feb 6, 2026 as the registration date. At collection time, the domain resolved to 104.21.0.92; hosting addresses can be shared, so this IP should not be treated as malicious solely because it appears here. The collected metadata suggests Binance as the apparent target.

These findings are time-bound, not a live guarantee. Avoid signing in or submitting sensitive information on this domain; open the expected service from an independently verified address instead. Submit an appeal if this report is inaccurate.