defi-bnb8[.]shop

This domain, defi-bnb8.shop, was registered on 22 February 2026 through Gname.com Pte. Ltd. and is currently active. It resolves to 104.21.75.223, an IP owned by Cloudflare, Inc. (AS13335) and is hosted behind Cloudflare’s reverse‑proxy service, indicating the attacker is leveraging the provider’s CDN and DDoS protection. The site serves content over HTTPS using a Google Trust Services / WE1 certificate, and HTTP requests return status 200. Detected front‑end technologies include Vue.js, jsDelivr, Axios, Cloudflare Browser Insights, and HTTP/3, suggesting a modern JavaScript‑driven interface. The page title reported by the scanner is “defi-ETH”, but no further content analysis is available. Infrastructure reputation is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on two security blocklists (PhishDestroy and ScamSniffer). VirusTotal records three of ninety‑five AV engines flagging the domain, reinforcing the malicious classification. The threat type is identified as a crypto drainer, indicating attempts to lure victims into transferring cryptocurrency to addresses controlled by the adversary. Defenders should treat defi-bnb8.shop as high‑risk. Immediate actions include adding the domain to DNS‑based blocklists, configuring web‑proxy filters to deny HTTP/HTTPS traffic to the host, and monitoring outbound connections for attempts to resolve or contact the IP. Because the site is behind Cloudflare, threat‑intel feeds that map Cloudflare‑proxied IPs to malicious activity should be consulted regularly. Continuous re‑scanning is advised to detect any changes in page content or additional malicious payloads.