webdisk[.]smartdefiprotocol[.]live

The domain webdisk.smartdefiprotocol.live was registered on 21 February 2026 through OwnRegistrar, Inc. and currently resolves to the IP address 188.114.96.3, which is advertised as part of AS13335 operated by Cloudflare, Inc. The authoritative name servers are greg.ns.cloudflare.com and marjory.ns.cloudflare.com, indicating that the domain is protected behind Cloudflare’s edge network. The TLS certificate presented is issued by Google Trust Services under the WE1 label, and the site returns an HTTP 403 response with the page title “Just a moment…”. Network fingerprinting shows the presence of Cloudflare Browser Insights and HTTP/3 support, confirming that the domain leverages Cloudflare’s performance and security stack. The site is listed on a single known security blocklist and has been flagged by PhishDestroy. VirusTotal reports a single positive detection out of 95 scanners, while Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Threat intelligence classifies the activity as a cryptocurrency drainer, a variant of crypto‑related scams that aim to exfiltrate digital assets from unsuspecting victims. The “Just a moment…” title is commonly used to mask underlying malicious redirects or scripts, although the exact payload has not been publicly disclosed. The high risk rating reflects the combination of recent domain creation, active status, and the presence of a low trust score, suggesting that the infrastructure is currently being used to target cryptocurrency users. Defenders should block traffic to 188.114.96.3 and to the fully qualified domain name webdisk.smartdefiprotocol.live at the DNS layer. Monitoring for outbound connections to Cloudflare‑proxied IP ranges associated with this domain can help detect compromised hosts. Incident response teams are advised to isolate any endpoint that exhibits attempts to resolve or contact this domain and to treat related alerts as high priority.