originslgnsdefi[.]live

originslgnsdefi.live was registered on 21 February 2026 through Web Commerce Communications Limited and points to Cloudflare’s network (ASN 13335) at 104.21.88.64, an IP located in the United States. The domain uses the default Cloudflare nameservers fred.ns.cloudflare.com and harmony.ns.cloudflare.com and does not present an SSL certificate, leaving the connection unencrypted. Gridinsoft assigns a trust score of 0 out of 100, indicating a completely untrusted reputation. The only visible page element is the HTML title “Origin”, and no further content has been disclosed publicly.

The site is classified as a crypto‑drainer scam, consistent with the “Crypto Scam” label supplied in the intelligence feed. Malware and phishing detection services have flagged the domain; four of ninety‑three VirusTotal scanners reported malicious activity, and the domain appears on seven external blocklists, including PhishDestroy, MetaMask, ScamSniffer, Polkadot and SEAL. The presence on multiple blocklists suggests that the infrastructure has been used to solicit cryptocurrency transfers or harvest private keys. As of the report date, the domain is reported as taken offline, which may be a temporary takedown or a deliberate shutdown by the operators.

Uncertainty remains regarding the exact payload or phishing page that was hosted, because no HTTP response body or JavaScript artifacts have been captured. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the IP address or associated Cloudflare nameservers, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of the registrar and nameserver configuration is advisable, as changes could indicate a re‑activation attempt. The limited forensic evidence currently limits attribution, but the combination of low trust score, lack of TLS, and multiple blocklist listings warrants an elevated risk rating.