web3-defi[.]ai

The domain web3-defi.ai was registered on 2026-02-21 and is presently offline. Infrastructure analysis shows it resolves to IP 47.89.217.190, which belongs to AS45102 Alibaba (US) Technology Co., Ltd., located in the United States. The SSL certificate is rated R10, indicating a low trust score. The page title returned from the host is "DeFi AI", matching the known scam type of a crypto scam.

VirusTotal recorded a single positive detection out of 95 scanned scanners, confirming that at least one security engine identified malicious behavior. The domain appears on one public blocklist and is actively blocked by PhishDestroy, reinforcing the classification as a crypto drainer. Because the site is no longer serving content, direct observation of payloads or phishing pages is not possible, leaving the exact delivery mechanism and victim interaction unknown.

Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any resurgence, and add the host to internal threat intel feeds. Network traffic to 47.89.217.190 should be inspected for anomalous cryptocurrency transaction attempts, and any endpoints that previously communicated with the domain should be scanned for residual malware. Continuous review of emerging detections on VirusTotal and blocklist updates is advised to capture any re-activation of the infrastructure.