defillama-es-com[.]pages[.]dev

The domain defillama-es-com.pages.dev is a cryptocurrency phishing site designed to function as a crypto drainer, a type of scam that siphons digital assets from victims' wallets. No legitimate brand or drainer kit was identified in association with this domain. As of the latest verification, defillama-es-com.pages.dev has been taken offline, though prior activity classified it as an elevated-risk threat targeting cryptocurrency users.

Technical indicators confirm the malicious nature of defillama-es-com.pages.dev. The domain was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and Phishing Database, while appearing on 3 security blocklists (PhishDestroy, MetaMask, and SEAL). Registered through Cloudflare, Inc. on February 25, 2026, the domain resolved to the IP address 172.66.47.81, hosted by Cloudflare in the US (AS13335). The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100. The site returned an HTTP 403 status at the time of assessment.

Users who interacted with defillama-es-com.pages.dev should immediately revoke any token approvals granted to unknown or suspicious contracts using tools like Etherscan or Revoke.cash. Funds should be transferred to a new, secure wallet to prevent further unauthorized access. Victims are advised to report the domain to their wallet provider, relevant blocklists (e.g., PhishTank), and local cybercrime authorities. Enabling transaction simulation tools and verifying contract addresses before approvals can reduce future risks.