dexbtc[.]org

Analysis of dexbtc.org indicates this domain was actively impersonating Ethereum as part of a cryptocurrency scam, as classified by available threat intelligence. The domain resolved to IP address 34.102.28.219, hosted on Google LLC infrastructure (AS396982) in the United States, and was registered on November 13, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. Nameservers point to henghost.earth.orderbox-dns.com, henghost.mars.orderbox-dns.com, and henghost.mercury.orderbox-dns.com, suggesting use of a shared or reseller DNS provider. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The page title was identified as 'BitMart', though the exact relationship between this branding and the Ethereum impersonation is not confirmed; no additional page content or kit details are available for analysis.

The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer, indicating prior detection by specialized anti-fraud tools. Gridinsoft assigned a trust score of 0/100, reflecting high-risk classification. While the domain is currently offline, its infrastructure remains a potential vector for re-emerging threats. Defenders should monitor for re-registration or IP reuse, particularly within Google Cloud or similar hosting environments.

Historical detection by multiple vendors suggests this was not an isolated or low-sophistication operation. No VirusTotal scan results are available for this domain, so detection coverage from broader security vendors is unknown. Given the domain's registration age and rapid takedown, this may represent a short-lived campaign targeting cryptocurrency users. Security teams should review logs for connections to 34.102.28.219 or the domain itself, particularly from users who may have interacted with Ethereum-related services or BitMart branding during the active period.