poloniexdefi[.]cc

Analysis indicates that poloniexdefi.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted behind Cloudflare (AS13335) with the IP address 172.67.128.143 located in the United States. The domain resolves to Cloudflare name servers aria.ns.cloudflare.com and arturo.ns.cloudflare.com and serves an HTTPS certificate issued by Google Trust Services (WE1). HTTP responses return status 200 and the site advertises HSTS, Vue.js, Cloudflare Browser Insights and HTTP/3. The page title returned is “Sorry, the website has been stopped”, which suggests the content is no longer available but the infrastructure remains active. Reputation data show the domain appears on a single security blocklist and received a Gridinsoft trust score of 0 / 100. It is listed by PhishDestroy and two of ninety‑three VirusTotal scanners have flagged it. The threat classification is a cryptocurrency drainer, consistent with the “crypto” scam type tag. No additional indicators such as malicious payloads or command‑and‑control traffic have been disclosed. Uncertainty remains around the current payload or victim interaction because the live page cannot be retrieved. Defenders should treat any traffic to poloniexdefi.cc as hostile. Recommended actions include blocking the domain at the DNS and proxy layers, monitoring outbound connections to the associated Cloudflare IP, and adding the domain to internal indicator lists. Continued observation of the IP reputation and periodic rescanning with sandbox tools is advised to detect any evolution of the threat.