scandefi[.]pro

The domain scandefi.pro was registered on February 21, 2026 through Dynadot LLC and currently resolves to the IP address 172.86.92.178, which is hosted by RouterHosting LLC in Germany. DNS resolution is delegated to ns1.dyna-ns.net and ns2.dyna-ns.net. The site presents an HTTPS endpoint secured by a Let’s Encrypt certificate (serial YE1) and returns an HTTP 301 status code, indicating a permanent redirect. Threat intelligence sources classify the activity as a crypto drainer, and the page title returned by the server matches the domain name itself. Reputation scoring is uniformly negative, with a Gridinsoft trust score of 0 out of 100. VirusTotal analysis shows that 15 of 93 security vendors have flagged the domain, and the domain appears on four external blocklists. Additional intelligence includes a single AlienVault OTX pulse referencing the domain and inclusion on blocklists operated by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The domain remains active and is assigned a high risk level. While the exact payload delivery mechanism has not been publicly disclosed, the convergence of low trust scores, multiple vendor detections, and blocklist listings strongly suggests malicious intent aimed at illicit cryptocurrency extraction. Defenders should block network traffic to 172.86.92.178, add scandefi.pro to domain filtering lists, and monitor for related indicators of compromise in endpoint and network logs. Further investigation is warranted to confirm the specific tactics employed by the campaign.