a[.]befid[.]top

This domain, a.befid.top, is identified as a crypto drainer phishing site impersonating a decentralized finance (DeFi) platform under the guise of "defi-ETH." The page title explicitly references DeFi-ETH, suggesting an intent to deceive users into connecting wallets or entering sensitive credentials, likely to siphon cryptocurrency assets. No specific drainer kit has been conclusively attributed to this campaign, but the combination of DeFi branding and the observed infrastructure aligns with known crypto drainer tactics. Analysis indicates the domain was registered on January 26, 2025, through NameSilo, LLC, and resolves to the IP address 104.21.72.102. Detection metrics reveal a VirusTotal score of 7/95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is assigned a trust score of 0/100 by Gridinsoft. Infrastructure analysis reveals the use of Google Cloud, Nginx, and Google Cloud CDN, which may have been leveraged to obfuscate the origin of the attack or enhance delivery speed. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than an absence of risk. The domain is currently offline, likely due to takedown efforts or abandonment by the threat actor. However, the infrastructure components, such as the cloud hosting and CDN, remain active and could be repurposed for future campaigns. Users who interacted with the domain prior to its takedown may still be at risk of wallet compromise or financial loss. It is recommended to monitor wallet transactions for unauthorized activity, revoke any suspicious connected dApp permissions, and verify the legitimacy of DeFi platforms before interacting with them. Organizations should update blocklists to include this domain and its associated IP to mitigate residual risk.