defipay[.]cc

defipay.cc is currently listed as an active crypto‑drainer infrastructure. The domain resolves to Cloudflare name servers guss.ns.cloudflare.com and mimi.ns.cloudflare.com, indicating use of Cloudflare’s DNS and likely its edge network for traffic forwarding. Registration was performed through Ascio Technologies, Inc. Danmark – Filial af Ascio technologies, Inc. USA, a registrar that has appeared in multiple malicious campaigns.

The site returns HTTP 200, confirming a live web service, and it has been added to one external security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 7 of 91 scanned security vendors flag it as malicious, reinforcing the suspicion of abuse. The threat is classified as a crypto drainer, a category that typically attempts to trick victims into transferring cryptocurrency to attacker‑controlled wallets.

No public page title, SSL certificate details, or host IP/ASN information are present in the current intelligence, leaving the full hosting footprint uncertain. Defenders should continue to block defipay.cc at DNS and proxy layers, monitor outbound connections for attempts to contact the domain, and incorporate the domain into threat‑intel feeds. Ongoing observation of any changes to its DNS records, SSL deployment, or detection scores is recommended to capture potential escalation.