defiai[.]pages[.]dev

This domain, defiai.pages.dev, is a confirmed crypto drainer targeting users of the Solana blockchain. The site operates under the pretense of a decentralized finance (DeFi) platform, using the page title 'defi-ai-web' to lure victims into connecting their cryptocurrency wallets. Once connected, the site is designed to execute unauthorized transactions, draining funds from the victim’s wallet without consent. The threat is classified as high-risk due to its direct financial impact and active exploitation of brand trust in Solana’s ecosystem. Analysis indicates the domain was registered on March 13, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, which is part of Cloudflare’s network (AS13335). The SSL certificate identifier is E7, and the domain is currently flagged by 1 out of 95 security vendors on VirusTotal. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages, a common tactic to leverage reputable infrastructure for malicious purposes. The domain appears on one security blocklist and is actively impersonating Solana, a well-known blockchain platform, to enhance its credibility and deceive users. If you visited defiai.pages.dev or interacted with the site, immediate action is required. First, disconnect any wallets or accounts linked to the site and revoke all connected dApp permissions using a wallet management tool. Next, scan your device for malware using updated security software to ensure no additional threats were introduced. Monitor your cryptocurrency wallet and associated accounts for unauthorized transactions, and report any suspicious activity to the relevant platform or authorities. If funds were stolen, document all details, including transaction hashes, and consider reporting the incident to law enforcement or a cybersecurity incident response team for further investigation.