m[.]deribitone[.]cc

This domain, m.deribitone.cc, was registered on July 16, 2026, through Dominet (HK) Limited and is currently active as of July 20, 2026. Infrastructure analysis reveals a dual nameserver configuration, utilizing both Cloudflare (anita.ns.cloudflare.com, leo.ns.cloudflare.com) and Alibaba DNS (ns7.alidns.com, ns8.alidns.com). The domain resolves to the IP address 188.114.96.3, a Cloudflare-hosted endpoint. It has been flagged by three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating a high-risk classification tied to cryptocurrency-related phishing activity. VirusTotal reports two detections out of 95 security vendors, though the specific nature of the threat remains unverified through direct content analysis. The domain’s registration details and nameserver diversity suggest an attempt to evade detection while maintaining operational resilience. Defenders should treat this domain as actively malicious, particularly in environments involving cryptocurrency transactions or MetaMask interactions. Further investigation into associated infrastructure, such as the IP address and linked domains, is recommended to identify broader campaign patterns. No confirmed brand impersonation or phishing kit details are available at this time.