purifier-arrogant[.]defex[.]cc

The domain purifier-arrogant.defex.cc was observed as offline at the time of analysis on July 24, 2026, returning an HTTP 403 status code and a page title of "404 Not Found." DNS resolution points to the Cloudflare‑owned address 172.67.209.39, with authoritative nameservers dana.ns.cloudflare.com and ethan.ns.cloudflare.com, indicating the site was hosted behind Cloudflare’s network (AS13335, United States). The SSL certificate presented is issued by Google Trust Services under the WE1 root, a typical Cloudflare‑provided certificate, confirming that TLS termination is performed by the CDN. Registration details show the domain was created on September 29, 2025 through NiceNIC International Group Co., Limited, a registrar often used for short‑lived malicious infrastructure.

Reputation signals are unfavorable: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal scans indicate that eight of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment. No additional content analysis is available beyond the 404 title, so the exact phishing campaign or targeted brand cannot be confirmed.

Defenders should immediately add purifier‑arrogant.defex.cc to web‑filter deny lists and consider blocking the associated Cloudflare IP 172.67.209.39, especially for traffic that matches the 403 response pattern. Monitoring for newly registered domains using the same registrar or similar naming conventions is advised, as is updating intrusion detection signatures to flag HTTP 403 responses coupled with Cloudflare‑served SSL certificates originating from this IP range. Continuous re‑scanning through multi‑vendor services is recommended to capture any future activity should the domain be re‑activated.