sredaloft[.]ru

This domain, sredaloft.ru, is actively impersonating Compound Finance, a decentralized finance (DeFi) protocol, as part of a crypto scam operation. Registered on February 21, 2026, the domain resolves to IP address 172.67.159.16, hosted on Cloudflare's infrastructure (AS13335) in the United States. The site returns an HTTP 200 status and employs Cloudflare technologies, including HTTP/3, alongside a Let's Encrypt SSL certificate (serial E8). Nameservers are configured as ram.ns.cloudflare.com and zelda.ns.cloudflare.com, consistent with Cloudflare's standard setup. Analysis indicates the page title 'Обзор Compound Finance: Передовой DeFi Проект' explicitly references Compound Finance, confirming the brand impersonation. The domain is flagged by at least one security blocklist and has been detected by 3 of 93 security vendors on VirusTotal, though the specific nature of these detections remains unverified. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious. Infrastructure review reveals no atypical hosting patterns, but the combination of Cloudflare's protective layers and the domain's recent registration aligns with common scam tactics to evade detection. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to and from 172.67.159.16. Given the crypto scam classification, users interacting with this site may be exposed to fraudulent investment schemes or credential harvesting. No evidence of additional payloads or redirect chains is currently available, but continued vigilance is recommended due to the domain's active status.