defirocket[.]ru

Analysis of defirocket.ru shows an active crypto‑drainer infrastructure. The domain resolves to 188.114.97.3, a Cloudflare‑served address located in the United States and identified as AS13335. HTTP requests return status 200 and the default nginx page title "Welcome to nginx!", indicating a bare web server without publicly visible malicious payloads. The site uses Cloudflare’s edge services and HTTP/3, and presents a Google Trust Services / WE1 TLS certificate, which does not mitigate the underlying threat. Registration data places creation on 21 February 2026, and the domain carries a Gridinsoft trust score of 0 / 100. It appears on two reputable blocklists (PhishDestroy and ScamSniffer) and has been flagged by two of ninety‑five VirusTotal scanners, reinforcing the high‑risk classification. The known intelligence labels the operation as a crypto scam, specifically a crypto drainer, but the exact mechanisms for asset exfiltration have not been observed. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP, and enforce strict outbound traffic controls to prevent potential wallet interactions. Continuous re‑evaluation is advised, as further malicious payloads may be deployed behind the current generic landing page.