derivetivas[.]cc

The domain derivetivas.cc was registered on June 14, 2025 through Gname.com Pte. Ltd. and currently resolves to the IP address 104.21.49.56, which is announced by AS13335 Cloudflare, Inc. and located in the United States. The authoritative nameservers listed are lennon.ns.cloudflare.com and monika.ns.cloudflare.com, indicating that the domain leverages Cloudflare’s DNS and CDN services. No TLS certificate is observed for the site, suggesting that HTTP connections are either unencrypted or the certificate was removed prior to takedown. The page title returned during the brief observation was "Uniswap," and the domain is explicitly associated with a crypto‑scam campaign targeting the Ethereum brand.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 out of 100, and Gridinsoft rates it 0 out of 100, reflecting a high likelihood of malicious intent. Threat intelligence feeds corroborate the risk; the domain appears on one security blocklist, has been flagged by 13 of 95 VirusTotal scanners, and is referenced in two AlienVault OTX pulses. PhishDestroy has also listed the domain as blocked.

The site is presently offline, but the infrastructure details remain active and could be reused for future campaigns. Defenders should continue to block the IP 104.21.49.56 at network perimeters, enforce DNS filtering against the domain and its Cloudflare nameservers, and monitor for any re‑registration attempts. Continuous observation of the associated IP range and rapid sharing of indicator data with threat‑sharing platforms are recommended to mitigate potential re‑use.