2024defivip[.]vip

Analysis of the domain 2024defivip.vip indicates that it was actively serving content on 2026-02-21, the same date the registration was created through Web Commerce Communications Limited. The authoritative name servers ns1.jtdnsv1.com and ns2.jtdnsv1.com resolve the domain to the IPv4 address 38.181.53.19, which is geolocated to Hong Kong and listed as belonging to Hong Kong Communications International Co., Limited. An HTTP GET request returned a 200 OK status and the page title was observed as “2024defivip.vip”, matching the domain string. The site was classified as a “Crypto Scam” and specifically identified as a crypto‑drainer operation.

Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on at least one public security blocklist. VirusTotal scans show that two of ninety‑three antivirus engines flagged the domain as malicious, confirming that detection signatures exist for this infrastructure. The domain was subsequently taken offline and is currently listed as “offline” by monitoring services, while the blocklist PhishDestroy continues to list it as blocked. Defenders should add 38.181.53.19 to network deny lists and ensure that DNS queries for 2024defivip.vip are blocked at the resolver level.

Security appliances that reference the observed blocklist or VirusTotal detections should be updated to include the domain and its associated IP. Continuous monitoring of the jtdnsv1.com name‑server pair is advised, as the same infrastructure may be reused for future malicious campaigns. Because the site was only recently created, threat‑intel feeds may not yet contain historical context; therefore, inclusion of the domain in internal watchlists and correlation with any observed crypto‑drainer traffic is recommended. The limited detection footprint—two vendor flags and a single blocklist entry—suggests that the campaign is in an early stage, and rapid containment can prevent further victim exposure.