exempt-surface-compounds-accommodations[.]trycloudflare[.]com

Analysis of exempt-surface-compounds-accommodations.trycloudflare.com indicates a high-risk crypto scam impersonating the Compound brand. The domain, registered on February 21, 2026, was taken offline by July 24, 2026, but remains a documented threat. Infrastructure analysis reveals it was hosted via Cloudflare Tunnel, resolving to IP 104.16.231.132 (AS13335, Cloudflare, Inc., US). No SSL certificate was detected, and the HTTP response showed an 'Index of /' page title, suggesting either a misconfigured or intentionally exposed directory listing rather than a polished phishing landing page.

The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 0/100. Sixteen of 93 security vendors on VirusTotal flagged the domain as malicious, though the exact nature of the threat content remains unconfirmed due to the domain's offline status. The scam type is classified as a crypto scam, targeting users of the Compound protocol, though no specific attack vector (e.g., token drainer, fake staking portal) is documented in available intelligence. Defenders should treat this domain as a confirmed brand impersonation threat.

The use of Cloudflare Tunnel infrastructure, combined with the absence of SSL and the directory listing, may indicate an opportunistic or low-effort campaign rather than a sophisticated operation. While the domain is currently offline, its prior detection by multiple security vendors and blocklists warrants continued monitoring for re-emergence or related infrastructure. Organizations should update blocklists to include this domain and any associated IPs, and security teams should review logs for prior connections to 104.16.231.132 during its active period.