driftprotocolscompliance[.]info

The domain driftprotocolscompliance.info has been identified as a brand impersonation threat targeting Drift, a known decentralized finance platform. Analysis confirms the domain was designed to mimic legitimate Drift services, likely to deceive users into disclosing sensitive information or interacting with malicious infrastructure. The domain is currently offline, but prior activity indicates a deliberate attempt to exploit trust in the Drift brand. Technical indicators reveal the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 26, 2026, an unusually future-dated creation that may suggest evasion tactics. It resolved to the IP address 104.21.68.61 and employed infrastructure protected by Cloudflare, including HTTP/3 and HSTS protocols, which are often leveraged to obscure malicious activity. Security vendors flagged the domain in 9 of 95 VirusTotal scans, while Gridinsoft assigned a trust score of 0/100. The domain also appears on one security blocklist, and its page title, 'Just a moment...,' aligns with patterns observed in transient phishing deployments. Current status confirms driftprotocolscompliance.info is offline, reducing immediate risk to users. However, the domain's infrastructure and registration details suggest potential for reactivation or reuse in future campaigns. Organizations and individuals are advised to proactively block the domain and its associated IP address (104.21.68.61) at the network level. Users who may have interacted with the domain should verify account integrity, particularly for Drift-related services, and monitor for unauthorized transactions or access attempts. Security teams should treat domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED with heightened scrutiny, given its association with this and similar threats.