dexorbit[.]appConfirmed abuse, neutralized

Case summary

Domain

dexorbit[.]app

First reported

11 October 2026

Confirmed

22 October 2026

Reports on file

1

Analyst write-up

Wallet-drainer dApp at dexorbit[.]app confirmed and neutralized

The reported domain dexorbit[.]app hosted a deceptive Web3 decentralized application that presented a fake DEX interface and a misleading "Trust check" modal. According to the case data, the embedded script prompted connected Solana-compatible wallets to authorize a transaction that moved the user's entire SOL balance to attacker-controlled recipient addresses. The site is classified as dedicated, meaning it was set up for this activity, and the threat is recorded as crypto-scam.

Timeline

The report was received on October 11, 2026 and the case was monitored by Fraudpol from the moment the report arrived. Notifications were sent through threat intelligence feeds, the hosting provider, and the domain registrar. The time to first action was 1 minute and the time to neutralization was 11 days. The case was marked neutralized on October 22, 2026, with the outcome: verified offline by our team.

Indicators

Deceptive "Trust check" modal with false trust claimsFake DEX interface with a "Launch DEX" promptAutomatic drainer transaction prompt on wallet connectionTransfer of entire SOL balance to attacker-controlled addressesSite uses Cloudflare

What to do

Do not connect a crypto wallet to unfamiliar decentralized applications, and never approve transactions you did not initiate. If you already approved a suspicious transaction, move remaining assets to a new wallet and review active wallet permissions.

Handling record

Offline since

22 October 2026

Evidence on file

Forensic evidence archived. Not published to protect the integrity of ongoing takedown work.

Reported to the responsible providers and security services.