defillama[.]de

Analysis of defillama.de, observed on July 23, 2026, indicates active malicious infrastructure targeting cryptocurrency assets. The domain resolves to 104.16.140.114, an address owned by Cloudflare, Inc. (AS13335) located in the United States. VirusTotal records show that seven of ninety‑five scanned security vendors have flagged the domain, reflecting a moderate detection consensus. Independent blocklist monitoring confirms inclusion on a single security blocklist, and the domain is explicitly blocked by the PhishDestroy service. The SSL certificate presented is issued by DigiCert Inc. under the Encryption Everywhere DV TLS CA - G2 hierarchy, confirming that the site employs valid TLS encryption despite its malicious purpose.

HTTP response headers indicate a permanent redirect (301), and the page title returned is "defillama.de steht zum Verkauf - Sedo.com," suggesting the domain is listed for sale on Sedo. Technical fingerprinting reveals the use of Cloudflare services, HSTS enforcement, and Apple iCloud Mail integration, while the authoritative name servers are sl1.sedo.com and sl2.sedo.com. MX records point to a localhost entry with priority zero, a configuration often associated with placeholder or non‑functional mail setups. Gridinsoft’s trust scoring assigns a rating of 0 out of 100, underscoring a lack of legitimate reputation.

The classification as a "Crypto Scam" and the broader threat label of "crypto drainer" are derived from the supplied intelligence, indicating attempts to illicitly transfer cryptocurrency holdings. No direct evidence of the payload or phishing pages has been captured; therefore, the precise delivery mechanism remains uncertain. Defenders should immediately block defillama.de at network perimeter and DNS layers, monitor the associated IP address for anomalous traffic, and add the domain to internal threat intelligence feeds.