defilllama[.]at

defilllama.at is currently active and has been classified as a crypto drainer. The domain resolves to the IPv4 address 159.198.39.251, which is hosted by an infrastructure associated with Hosting concepts B.V. and listed under Registrar.eu (https://nic.at/registrar/648). VirusTotal records indicate that five of ninety‑one scanned security vendors have flagged the domain, demonstrating partial detection across the scanning ecosystem. The domain appears on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, reinforcing its malicious reputation.

Authoritative name resolution is provided by the DNSPod nameservers a.dnspod.com, b.dnspod.com and c.dnspod.com, a configuration commonly observed in compromised or rapidly deployed malicious infrastructures. No additional metadata such as page title, SSL certificate details, or HTTP response codes have been published, so the exact content served by the site remains unverified. The threat profile assigns a high risk level and references a unique seed identifier 53ae85.

Defenders should add defilllama.at and its resolving IP address to network‑level deny lists, enforce client‑side blocking in browser extensions, and monitor for related activity in threat‑intel feeds. Verification that wallet extensions like MetaMask honor the existing blocklists is advisable to mitigate credential or private‑key harvesting attempts. Continuous re‑evaluation is recommended, as changes to hosting, DNS configuration, or detection scores may alter the threat profile.