dex-byreal[.]com

Analysis of the domain dex-byreal.com, registered on July 17, 2026, reveals infrastructure consistent with phishing operations targeting trusted service portals. The domain is currently active and resolves to the IP address 186.2.175.35. It employs nameservers ares.trustname.com, zeus.trustname.com, ns1.anycastdns.cz, and ns2.anycastdns.cz, suggesting a reliance on both Trustname and AnycastDNS infrastructure, which may indicate an attempt to distribute DNS resolution across multiple providers for resilience. The registrar, Fewmoretaps OU d/b/a Trustname.com, is known for low-cost domain registrations, a common characteristic among threat actors seeking to minimize traceability and cost.

As of July 22, 2026, the domain appears on one security blocklist, specifically PhishDestroy, which indicates prior detection by at least one automated or community-driven threat intelligence feed. The absence of detections from the 95 vendors that scanned the domain on VirusTotal does not confirm its legitimacy; rather, it highlights the limitations of signature-based detection for newly registered or low-prevalence domains. The lack of widespread flagging may also reflect a lag in detection coverage or the use of evasion techniques such as cloaking or geofencing. The exact content or target of the phishing campaign hosted on dex-byreal.com remains unconfirmed, as no specific brand, page title, or scam type has been identified in available intelligence.

Defenders should treat this domain as high-risk due to its recent registration, active status, and inclusion on a security blocklist. Recommended actions include monitoring for connections to 186.2.175.35, blocking the domain at the DNS or proxy level, and investigating any internal network traffic associated with it. Further analysis, such as sandbox execution or manual inspection of the site’s content, may provide additional context regarding its intended use or target.