brandhair[.]ru

Analysis of the domain brandhair.ru indicates a confirmed case of brand impersonation targeting Benqi, a known entity in the decentralized finance sector. The domain, currently offline, was flagged by PhishDestroy and appears on one security blocklist, reflecting elevated risk. Infrastructure analysis reveals the domain resolves to IP address 104.21.61.67, hosted on Cloudflare's network (AS13335) in the United States. Registration details show the domain was provisioned through Cloudflare, Inc., a common choice for both legitimate and malicious actors due to its privacy and proxy services. The SSL certificate is issued by Google Trust Services (WE1), a standard certificate authority, offering no immediate red flags beyond its association with the domain.

Detected technologies include Amazon Web Services, Cloudflare, and Cloudflare Browser Insights, consistent with modern web hosting but not inherently indicative of malicious intent. The domain's nameservers (aria.ns.cloudflare.com and art.ns.cloudflare.com) further confirm its reliance on Cloudflare infrastructure. VirusTotal reports a single detection from 95 security vendors, a modest but notable signal given the domain's offline status and limited exposure. The page title, 'QiDao обзор: Полный анализ проекта,' suggests content related to a project review, potentially leveraging the QiDao name to lend credibility to the impersonation scheme. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk.

Defenders should treat this domain as a confirmed brand impersonation vector. While the domain is offline, its infrastructure remains intact, and reactivation is possible. Monitoring for DNS resolution changes, SSL certificate updates, or renewed hosting activity is recommended. Security teams should review logs for prior connections to 104.21.61.67 or the domain itself, particularly in contexts involving Benqi or QiDao-related communications.