defillama-app-vert[.]vercel[.]app

defillama-app-vert.vercel.app has been identified as a crypto drainer, a specific type of phishing threat designed to steal cryptocurrency assets. The domain is currently offline, but its recent activity posed a high risk to users. This site was likely impersonating the legitimate DeFi Llama platform to trick visitors into connecting their wallets, which would then trigger a drainer script to transfer funds to attackers.

Technical indicators paint a clear picture of malicious intent. The domain was created on February 21, 2026, registered through Tucows Domains Inc., and resolved to IP 64.29.17.3. It was flagged by 13 out of 95 security vendors on VirusTotal and appeared on at least one security blocklist. Google Safe Browsing also flagged it for phishing, and the SSL certificate was issued by Google Trust Services (WR1). Despite these red flags, the page title displayed a 404 error, suggesting the site may have been taken down quickly or was in a testing phase.

Given that this domain is now offline, the immediate threat has diminished, but users should remain vigilant. Recommendations include never connecting a cryptocurrency wallet to unknown or unverified sites, especially those impersonating well-known platforms. Always double-check URLs and use browser security extensions that block known phishing domains. If you have already interacted with this site, immediately revoke any wallet permissions and transfer assets to a new wallet. Continuous monitoring of blocklists and threat intelligence feeds is advised to stay ahead of similar emerging threats.