prdt[.]fi

Analysis of prdt.fi, created on 21 February 2026, shows infrastructure consistent with a high‑risk crypto‑related phishing operation. The domain resolves to IP 76.76.21.21, which is allocated to AS16509 Amazon.com, Inc. and geolocated in the United States. Hosting on Amazon‑owned infrastructure is common for short‑lived malicious sites that leverage reputable cloud services to evade simple network‑based blocks. The domain is registered through Immaterialism Ltd and uses three Njalla nameservers (1‑you.njalla.no, 2‑can.njalla.in, 3‑get), a registrar often associated with privacy‑focused or abuse‑tolerant services. The site serves a page titled “PRDT Finance: Your DeFi Gateway to Crypto Price Predictions”, indicating a cryptocurrency‑focused lure.

Technical fingerprinting reveals a modern JavaScript stack: Node.js, React, Next.js on Vercel, with Google Tag Manager, reCAPTCHA, HSTS, and Twitter Ads integration. The TLS certificate is issued by Let’s Encrypt (R12), providing valid encryption but no indication of legitimacy. Detection data corroborates malicious intent. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports that 2 of 93 scanners have flagged the host, and the Gridinsoft trust score is 0 / 100, the lowest possible rating.

HTTP response code 200 confirms that the site is reachable and serving content. While the content of the page has not been examined, the combination of a newly registered domain, cloud‑based IP, privacy‑preserving registrar, low trust scores, and multiple blocklist entries strongly suggests a phishing campaign aimed at deceiving users of DeFi platforms. Defenders should add prdt.fi to URL filtering and endpoint protection rules, monitor DNS queries for the listed Njalla nameservers, and consider temporary sink‑holing of the IP address. Continuous re‑evaluation is advised in case additional detections emerge.