deficores[.]com

This domain, deficores.com, is identified as a crypto drainer infrastructure component, designed to siphon cryptocurrency assets from victims through deceptive transaction prompts or wallet-draining scripts. No legitimate brand association or frontend content is observed; the site currently displays a generic 'Problem loading page' error, which may indicate either a staging environment, backend-only operation, or a placeholder for future malicious deployment. Analysis of the domain’s infrastructure reveals no identifiable drainer kit branding (e.g., Angel Drainer, Inferno Drainer), suggesting either a custom or obfuscated toolset in use. Infrastructure analysis provides the following technical indicators: the domain resolves to IP address 172.67.149.96, a Cloudflare-assigned endpoint that may obscure the true origin server. No SSL certificate is present, increasing the risk of interception or tampering during data transmission. The domain is registered through HOSTINGER operations, UAB, a registrar frequently observed in malicious infrastructure due to its low-cost and permissive registration policies. VirusTotal detection metrics show 3/95 security vendors flagging the domain as malicious, a relatively low ratio that may reflect either evasion techniques or limited exposure. The domain appears on a single security blocklist, and no Google Safe Browsing (GSB) detections are recorded at this time. Historical WHOIS data is unavailable due to privacy protections, but the domain’s active status and lack of legitimate content strongly correlate with malicious intent. As of the latest verification, deficores.com remains operational, posing an ongoing risk to users who may encounter it through phishing links, malvertising, or compromised third-party platforms. The absence of SSL and minimal blocklist coverage suggest the infrastructure is either newly deployed or actively evading detection. Users are advised to treat this domain as hostile and avoid any interaction, including wallet connections or transaction approvals. Wallet providers and security teams should prioritize blocking the domain and its associated IP address, while monitoring for related infrastructure (e.g., subdomains, linked IPs) that may emerge as part of the same campaign. The high-risk classification is maintained due to the domain’s direct association with cryptocurrency theft and its active status.