cetus-dlmm-beta[.]netlify[.]app

This domain, cetus-dlmm-beta.netlify.app, poses a high-risk phishing threat specifically targeting cryptocurrency and decentralized finance (DeFi) users. The site mimics the branding and interface of a legitimate liquidity protocol, using the page title 'Cetus - Empower liquidity. Built for DeFi.' to deceive visitors into entering sensitive credentials, such as wallet private keys or recovery phrases. Analysis indicates the infrastructure is designed to harvest authentication details under the guise of a trusted DeFi service, enabling unauthorized access to digital assets and financial theft. Infrastructure analysis reveals multiple indicators of malicious intent. The domain is hosted on Netlify and resolves to the IP address 35.157.26.135, located in Germany under Amazon.com, Inc. (AS16509). It is currently flagged by 3 out of 95 security vendors on VirusTotal, and appears on one security blocklist, specifically PhishDestroy. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), is valid but does not mitigate the underlying phishing risk. The domain remains active, increasing the likelihood of ongoing fraudulent activity. Users who have visited cetus-dlmm-beta.netlify.app or interacted with its content should take immediate action to secure their assets. Any credentials, wallet addresses, or private keys entered on the site should be considered compromised. Affected users are advised to transfer funds to a new, secure wallet, revoke any connected smart contract approvals, and monitor transaction histories for unauthorized activity. Additionally, scanning local devices for malware and updating security software is recommended to prevent further exploitation. If financial loss has occurred, reporting the incident to relevant blockchain analysis platforms and law enforcement cybercrime units is strongly encouraged.