defi-trustpads[.]xyz

Analysis of defi-trustpads.xyz shows a domain registered on July 29 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is actively resolving to the IPv4 address 188.114.96.3 and uses Cloudflare authoritative nameservers alec.ns.cloudflare.com and amalia.ns.cloudflare.com. HTTPS is enabled with a certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS chain. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, which classifies it as a crypto‑drainer.

VirusTotal records indicate the site was scanned by 91 antivirus and URL‑reputation engines, none of which reported a detection; the lack of a detection does not constitute evidence of benign intent. No public Safe Browsing, OTX, or page‑title information is currently available for this host. The short registration window, recent creation date, and immediate appearance on a blocklist suggest an intentional malicious deployment rather than a benign test or typo‑squat.

Defenders should treat the domain as hostile: block DNS resolution and HTTP/S traffic at perimeter devices, add the IP address 188.114.96.3 to network‑level deny lists, and monitor outbound connections for any attempts to contact the domain. Continuous re‑evaluation is advised, as the threat is listed as “under investigation” and the activity status remains active. Logging of TLS handshake details and any payloads exchanged with the host will aid future attribution and mitigation efforts.