gain-compound[.]com

Analysis of gain-compound.com, registered on 21 February 2026 through NiceNIC International Group Co., Limited, shows infrastructure typical of a brand‑impersonation crypto scam targeting Compound. The domain resolves to 172.67.140.8, an address owned by Cloudflare (AS13335) located in the United States. Cloudflare‑provided nameservers anton.ns.cloudflare.com and reza.ns.cloudflare.com confirm the use of Cloudflare's DNS and edge services. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS connection but offering no authentication of the underlying site.

An HTTP request returns a 403 status, and the page title reported by crawlers is “Compound Labs • Community Drop”, directly referencing the Compound brand and suggesting an attempt to lure users interested in Compound’s community offerings. VirusTotal analysis records three of ninety‑three scanning engines flagging the domain as malicious, and the domain is listed on three public blocklists. Additional defensive feeds, including PhishDestroy, MetaMask, and SEAL, have actively blocked the domain. The site was identified as a crypto‑related scam, although no further payload or transaction details have been disclosed.

Current observations indicate the domain has been taken offline, but the infrastructure remains under control of the attacker and could be re‑activated. Defenders should continue to monitor the IP address 172.67.140.8 for any future activity, enforce blocklist updates, and add gain-compound.com to internal phishing and URL filtering rules. Because the domain uses legitimate Cloudflare and Google certificate services, traditional reputation checks may be insufficient; correlation with brand‑impersonation indicators such as the page title and the known target (Compound) is recommended.