origindefidesktop[.]io

origindefidesktop.io was registered through NameSilo, LLC on 17 October 2025. The domain resolves to the IP address 192.3.190.189, which belongs to the HostPapa network (AS36352) and is geolocated in the United States. Nameservers dns1.webproserver.com and dns2.webproserver.com are configured for the domain. No TLS certificate is presented, indicating that connections are made over plain HTTP. The only visible page returns the title "Verification", matching the known "Verification Scam" kit used in crypto‑drainer campaigns. Gridinsoft assigns a trust score of 0 out of 100, reflecting the extreme lack of reputation.

The domain appears on a single public blocklist, PhishDestroy, and has been flagged by three of ninety‑five VirusTotal scanners, confirming malicious intent. The site is currently taken offline, but the infrastructure remains observable. Analysis indicates that the domain was designed to lure victims into submitting cryptocurrency wallet credentials or authorizing transactions, a typical behavior of crypto‑drainer operations. The lack of SSL, low trust score, and the presence of a verification‑type page are consistent with illicit credential‑harvesting tactics. While the exact payload and landing pages have not been captured, the combination of registrar, hosting, and detection data provides sufficient confidence to classify the domain as a crypto drainer. Defenders should add 192.3.190.189 to network‑level blocklists and enforce denial of outbound connections to this IP.

The domain name itself should be included in DNS sinkhole or firewall deny lists. Monitoring for any future re‑registration or similar naming patterns is advised, as threat actors often recycle naming conventions. Organizations using web filtering should ensure that the domain is blocked in content‑filter solutions. Because the site currently returns no SSL certificate, any attempt to force HTTPS will fail, offering an additional mitigation point.