rewdex[.]top

This domain, rewdex.top, is flagged as part of a brand impersonation campaign targeting Ethereum users. Analysis indicates the infrastructure was designed to mimic legitimate Ethereum services, likely to deceive users into disclosing wallet credentials or interacting with malicious smart contracts. No direct evidence of a crypto drainer kit was observed, but the domain aligns with known patterns of Ethereum-focused phishing operations, including fake login portals or fraudulent token airdrop schemes. Infrastructure analysis reveals the following technical indicators: rewdex.top was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, with a creation date of April 04, 2026. The domain resolved to IP address 188.114.97.3 and was flagged by 2 out of 95 security vendors on VirusTotal. Gridinsoft assigned a trust score of 0/100, and the domain appeared on one security blocklist, specifically PhishDestroy. No detections were recorded in Google Safe Browsing at the time of analysis. The domain is currently offline, reducing immediate risk to users. However, the infrastructure may resurface under a different domain or IP address, a common tactic in phishing campaigns. Registrants often reuse registrar services and hosting providers, so monitoring for new domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to 188.114.97.3 is recommended. Users who interacted with rewdex.top should revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of any Ethereum-related communications. The elevated risk level reflects the domain's historical association with brand impersonation and its potential to re-emerge in future campaigns.