defichain-5gm[.]pages[.]dev

Analysis of defichain-5gm.pages.dev indicates that the domain is actively associated with a crypto drainer operation. The site is hosted behind Cloudflare, as evidenced by the DNS resolution to 188.114.96.3, which belongs to AS13335 owned by Cloudflare, Inc., and by the presence of Cloudflare nameservers lex.ns.cloudflare.com and maisie.ns.cloudflare.com. The HTTPS endpoint presents an E7‑rated SSL certificate and enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3, suggesting a modern web stack. The page title returned from the server is "DebbugDappNode," which does not correspond to any legitimate brand and aligns with the observed scam type of "Crypto Scam" in the intelligence feed.

The domain was registered on March 8, 2026 through Cloudflare, Inc., and has already been taken offline, a status confirmed by the current offline flag. Reputation data shows the domain appears on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal scans report that three of ninety‑four security vendors flagged the domain, providing additional corroboration of malicious activity.

No further public threat intelligence (e.g., OTX, Safe Browsing) is available for this host. Given the limited exposure window, defenders should continue to block the domain at the DNS and proxy layers, monitor for any resurrection attempts on the same IP address or adjacent Cloudflare‑assigned subdomains, and incorporate the observed indicators (IP 188.114.96.3, page title "DebbugDappNode," SSL grade E7, HSTS, HTTP/3) into detection rules. Organizations that use cryptocurrency wallets or DeFi services should treat any unsolicited communications referencing DeFi or "DefiChain" as potentially originating from this infrastructure and enforce multi‑factor authentication and transaction verification controls.