defi-wallets[.]icu

defi-wallets.icu is a newly registered domain (creation date February 21 2026) that is associated with a crypto‑drainer campaign. The domain was registered through Web Commerce Communications Ltd and delegated to the nameservers ns100.webnic.cc and ns101.webnic.cc. DNS resolution points to 104.21.64.1, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented the HTTP page title “Just a moment…”, and the SSL certificate is identified as WE1. Automated scanning on VirusTotal recorded 2 detections out of 95 security vendors, confirming malicious activity.

The domain has been added to seven independent security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, Polkadot, and SEAL, indicating consensus among multiple threat‑intelligence feeds that the site attempts to illicitly siphon cryptocurrency assets. The current operational status is offline, suggesting that the infrastructure has been taken down or is temporarily unavailable. Analysis indicates that the primary risk vector is credential or private‑key harvesting aimed at draining crypto wallets, consistent with the listed scam type “Crypto Scam”. The presence of the Cloudflare front‑end may be used to obscure the true origin of the malicious server.

No additional content, such as login forms or specific phishing pages, has been observed, and the exact payload or malware family remains unknown. Defenders should continue to block the domain at network perimeters, enforce DNS filtering against the identified blocklists, and monitor for any outbound connections to IP 104.21.64.1. Users of crypto wallet extensions should be advised to avoid any prompts originating from this domain and to revoke any authorizations that may have been granted. Threat‑intel teams should keep the domain under observation for possible re‑activation and correlate any future alerts that reference the same registrar, nameservers, or IP space.