defi[.]xn--looprng-cza[.]org

defi.xn--looprng-cza.org was registered through Dynadot LLC on 21 February 2026. The domain resolves to the Cloudflare‑owned address 104.21.45.9, associated with AS13335 in the United States. DNS resolution is served by felipe.ns.cloudflare.com and harleigh.ns.cloudflare.com, confirming Cloudflare as the authoritative name‑server provider. An active TLS certificate issued by Let’s Encrypt (certificate profile E7) was observed, and the web server responded with HTTP 200 over HTTP/3, indicating the presence of PHP‑based application logic behind the Cloudflare edge.

VirusTotal records show that the domain has been scanned by 93 different antivirus and URL‑reputation vendors; none of those engines flagged the host at the time of analysis. The site has been listed on a single external security blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. The only publicly disclosed activity type is "Crypto Scam," and the intelligence source classifies the threat as a "crypto drainer." No additional payload hashes, command‑and‑control endpoints, or credential‑stealing mechanisms have been disclosed.

The combination of a recent registration date, Cloudflare front‑end, a valid Let’s Encrypt certificate, and a zero trust score is consistent with infrastructure frequently used for short‑lived cryptocurrency‑draining campaigns. Given the lack of detections but the presence of multiple risk indicators, defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the IP 104.21.45.9 and its associated CNAME records, and enforce TLS inspection where possible to detect any future content changes. Periodic re‑scanning on VirusTotal and other reputation services is recommended, as the site may reactivate or alter its payload after the current offline status.