defi-carrot[.]xyz

The domain defi-carrot.xyz was registered on July 21, 2026 through Unstoppable Domains Inc. and is hosted on the nameservers ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. DNS resolution points to the IPv4 address 186.2.175.103. The domain is currently active and appears on a single security blocklist; it is also listed as blocked by the PhishDestroy feed. VirusTotal has processed the domain with 95 scanning engines, none of which returned a detection at the time of analysis.

This lack of detections does not constitute a safety guarantee, as the domain’s activity may be evading existing signatures. No public Safe Browsing, OTX, SSL certificate, HTTP status code, trust‑score, or page‑title information is available in the current intelligence set, indicating that those facets have not yet been observed or published. The limited visible infrastructure—namely the registrar, nameservers, and hosting IP—suggests a low‑profile deployment, typical of fast‑flux or disposable domains used for crypto‑draining campaigns. Defenders should treat the domain as malicious pending further verification.

Recommended actions include adding defi-carrot.xyz to local deny‑lists, blocking outbound connections to 186.2.175.103 at network perimeter devices, and monitoring DNS query logs for any resolution attempts. Integration of the domain into threat‑intel platforms and continuous re‑scanning with updated vendor engines are advised to capture any future changes in behavior or detection status. Until additional payload or phishing page analysis is released, the domain should be considered a high‑risk indicator for crypto‑drainer activity.