defi-syntax[.]in

This domain is identified as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency assets from victims' wallets through deceptive smart contract interactions. Analysis indicates the site masquerades as a legitimate blockchain node service, leveraging the title 'Blockchain Node - Multiverse support' to lure users into connecting their wallets. Once connected, the drainer executes unauthorized transactions, transferring funds to attacker-controlled addresses without user consent. The threat primarily targets decentralized finance (DeFi) participants, exploiting their familiarity with node-based services and multichain ecosystems to bypass initial suspicion. Evidence supporting this assessment includes multiple technical indicators and third-party validations. The domain was registered on March 15, 2025, through Tucows Domains Inc., and currently resolves to the IP address 188.114.96.3. It appears on 5 distinct security blocklists, including entries from major threat intelligence platforms. VirusTotal reports that 4 out of 95 security vendors flag this domain as malicious, while its Scamadviser trust score stands at 11 out of 100, indicating an extremely high risk of fraudulent activity. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, which are commonly employed to obfuscate the true origin of malicious traffic and evade detection. Users who have visited defi-syntax.in or interacted with its content should take immediate action to mitigate potential losses. First, disconnect any wallets that were connected to the site and revoke all active smart contract approvals using a trusted blockchain explorer or wallet management tool. Monitor wallet activity for unauthorized transactions and transfer remaining assets to a new, secure wallet if any suspicious activity is detected. Additionally, scan the device used to access the site for malware, as crypto drainers may deploy secondary payloads to maintain persistence. Report the domain to relevant security communities and consider filing a report with local cybercrime authorities to aid in tracking and disrupting the threat actor's operations.