dexalote[.]org

Analysis of dexalote.org indicates this domain was actively used in a phishing operation targeting users through a deceptive search interface. Registered on February 21, 2026, via NameSilo, LLC, the domain resolved to 172.234.25.64, an IP address hosted on Akamai Connected Cloud (AS63949) in the United States. The site's page title, 'Category Search,' suggests an attempt to mimic a legitimate search or directory service, though the exact content and targeted brand remain unconfirmed due to the domain's current offline status. Infrastructure analysis reveals the use of Nginx and OpenResty web server technologies, common in both legitimate and malicious deployments. The domain was served with a Let's Encrypt SSL certificate (R12), providing encrypted connections to users. While encryption is standard, it does not inherently validate the site's legitimacy.

The domain's nameservers (ns1.ns306.parklogic.com and ns2.ns306.parklogic.com) are associated with a known domain parking and monetization service, which has been observed in previous phishing campaigns. Detection data shows limited but consistent signals of malicious activity. As of the report date, one of 93 security vendors on VirusTotal flagged the domain as malicious. Additionally, the domain appears on two security blocklists (PhishDestroy and ScamSniffer) and was included in one AlienVault OTX threat intelligence pulse. Gridinsoft assigned a trust score of 0/100, further indicating high suspicion. The domain's inclusion in these sources aligns with its classification as a generic phishing threat, though the specific lure or payload remains unanalyzed.

Defenders should treat dexalote.org as compromised infrastructure. Network-level blocking is recommended for the domain and its associated IP (172.243.25.64). Security teams should review logs for connections to this domain, particularly from February 2026 onward, and investigate any related user reports or alerts.