defilama-io-join[.]pages[.]dev

The domain defilama-io-join.pages.dev was observed delivering a wallet‑seed phishing page that mimics the DefiLlama brand, as indicated by its page title "DefiLlama Wallet | @Explore DeFi with Transparency*". The site resolves to the IP address 172.66.44.173, which is owned by Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration data shows the domain was created on September 02, 2020 and is registered through Cloudflare, Inc., using the nameservers adi.ns.cloudflare.com, karl.ns.cloudflare.com, leland.ns.cloudflare.com, and wren.ns.cl. The HTTPS endpoint returns an HTTP 403 status, and the TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming a valid SSL chain.

The service is protected by HSTS and supports HTTP/3, both typical of Cloudflare‑hosted sites. Reputation services flag the domain as high risk: Google Safe Browsing categorises it as social engineering, PhishDestroy has blocked it, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that 12 of 93 scanned security vendors marked the domain as malicious, and it appears on one external blocklist. The site is currently offline, as indicated by the status field.

While the technical infrastructure (Cloudflare hosting, valid SSL, HSTS) is legitimate, the combination of brand‑impersonating page title, seed‑phishing classification, and multiple security vendor detections points to a coordinated credential‑harvesting campaign. Defenders should add the domain and its associated IP address to inbound and outbound blocklists, monitor DNS queries for the domain and its nameservers, and enforce strict verification of any DefiLlama‑related wallet interactions. Continued surveillance of Cloudflare‑hosted subdomains with similar naming patterns is recommended to detect future iterations of this threat.