dexintegrations[.]netlify[.]app

dexintegrations.netlify.app is a tenant hostname on Netlify, not a separately registered domain. PhishDestroy first recorded this hostname on Aug 22, 2025. The assembled evidence scores 97/100 (critical).

Five independent sources are positive: VirusTotal, Polkadot, Enkrypt, Codeesura, and Google Safe Browsing. VirusTotal recorded 14 detections among 95 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, CyRadar, ESET, Fortinet, G-Data, Google Safebrowsing, Kaspersky, Lionic, Sophos, VIPRE, Webroot on Jul 18, 2026 at 18:45 UTC. Polkadot, Enkrypt, and Codeesura listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing flagged the domain: Social Engineering on Feb 25, 2026 at 20:32 UTC. The evidence is not unanimous. URLQuery recorded no positive detection. URLScan completed without a malicious verdict on Mar 5, 2026 at 22:47 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:02 UTC; content was unavailable. Netlify is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 2a05:d014:58f:6200::259 on AS16509 (AMAZON-02, US). The associated network metadata labels the endpoint as AS16509 Amazon.com, Inc. in Frankfurt am Main, DE. This is shared platform infrastructure; the IP and ASN are hosting context, not attribution to unrelated tenants. The stored server header is Netlify. Captured page title: “Site not found”. DOM analysis completed on Jul 29, 2026 at 04:18 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 3, 2026 at 04:03 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. The platform TLS certificate was issued by DigiCert Inc / DigiCert Global G2 TLS RSA SHA256 2020 CA1 with validity through Mar 19, 2027; checked Mar 11, 2026 at 12:42 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as phishing. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.