dragonfly-protocol[.]net

The domain dragonfly-protocol.net is currently active and has been classified as a high‑risk generic phishing site. Infrastructure analysis shows the domain is hosted behind Cloudflare (nameservers ivan.ns.cloudflare.com, sandy.ns.cloudflare.com) and resolves to the IP address 172.67.155.62, which is located in Canada. The site presents a default HTTP 200 response with the page title “Default Site” and serves a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid SSL termination. Registration data reveals the registrar as NICENIC INTERNATIONAL GROUP CO., LIMITED, but no further registrant details are disclosed. The domain appears on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services. AlienVault OTX has referenced the domain in two separate threat pulses, and VirusTotal reports that fifteen of ninety‑one scanned scanners have flagged the host as malicious. While the exact phishing lure or targeted brand has not been disclosed in the available intelligence, the combination of a generic default site, reputable hosting, and multiple detections suggests active exploitation. Defenders should add dragonfly-protocol.net to deny‑list rules across firewalls, DNS filters, and email gateways, monitor outbound traffic for connections to the 172.67.155.62 address, and consider threat‑intel sharing with upstream providers to accelerate remediation.