cpcontacts[.]smartdefiprotocol[.]live

Analysis of the domain cpcontacts.smartdefiprotocol.live indicates active infrastructure associated with a cryptocurrency drainer campaign. The domain was registered on February 21, 2026, through OwnRegistrar, Inc., and currently resolves to the IP address 188.114.96.3, which is part of AS13335 (Cloudflare, Inc.) located in the United States. The domain employs Cloudflare nameservers (greg.ns.cloudflare.com and marjory.ns.cloudflare.com) and utilizes HTTP/3, a configuration consistent with modern phishing or scam infrastructure designed to evade detection and improve performance. The domain is flagged by one security vendor on VirusTotal, while GridinSoft assigns it a trust score of 0/100, further supporting its classification as malicious. Additionally, it appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors leveraging reputable certificate authorities to lend legitimacy to fraudulent domains. The HTTP status code 403 suggests the server is actively rejecting direct access, potentially as a measure to avoid automated scanning or to restrict access to specific user agents or geolocations. The page title 'Just a moment...' is a default response often associated with Cloudflare-protected sites undergoing verification or filtering, which may indicate the domain is part of a larger, automated campaign. The scam type is explicitly classified as cryptocurrency-related, though the exact mechanics of the drainer (e.g., wallet connection prompts, fake token swaps) remain unconfirmed due to the lack of direct page analysis. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Monitoring for related subdomains or newly registered domains under the same registrar may help identify additional components of this campaign.