deficncn[.]com

deficncn.com was registered on 21 February 2026 through Gname.com Pte. Ltd. and currently resolves to the Cloudflare‑owned address 172.67.169.218, advertised under AS13335 in the United States. The site serves content over HTTPS with a certificate issued by Google Trust Services (WE1) and returns HTTP 200 responses. Infrastructure analysis shows the domain is protected by Cloudflare, employing HTTP/3 and a Facebook Pixel tracker. Reputation data indicate that three of ninety‑five VirusTotal scanners have flagged the domain, and it is listed on two independent blocklists (PhishDestroy and ScamSniffer). The Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The threat classification is a cryptocurrency drainer, consistent with the page title “DeFi”. While the exact draining payload has not been observed, the combination of a recent registration, low trust score, active blocklist listings, and detection by multiple security vendors suggests a high‑risk profile. Defenders should treat any traffic to deficncn.com as hostile, block the domain at the DNS or proxy layer, monitor for related C2 activity on the associated IP range, and ensure that endpoint controls flag attempts to interact with the site. Continuous re‑evaluation is advised in case additional indicators emerge.