defillama--waallet[.]typedream[.]app

The domain defillama--waallet.typedream.app was created on 22 January 2021 and is registered through Squarespace Domains II LLC. Its authoritative name servers are annalise.ns.cloudflare.com and darwin.ns.cloudflare.com, and the domain resolves to IP address 104.21.37.85, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, indicating the use of Google‑managed SSL. A content fingerprint from VirusTotal shows that 12 of 95 scanning engines have flagged the domain as malicious, and it appears on at least one external security blocklist. Google Safe Browsing has classified the URL as a social‑engineering threat, and the blocklist PhishDestroy also lists it as blocked.

The page title returned by the host is "DeFiLlama Wallet | Track & Manage Your DeFi Assets," yet the HTTP response is a 404 status, suggesting that the malicious landing page is no longer reachable. Infrastructure analysis reveals a stack composed of Node.js, React, Next.js, Google Cloud services (including Trace and CDN), and Cloudflare Browser Insights, all of which are typical of modern web applications but provide a credible façade for credential‑stealing or fund‑draining activity. Scamadviser assigns a trust score of 1 / 100, reinforcing the low credibility of the site. The primary uncertainty is the exact payload that was delivered when the site was active; because the HTTP endpoint now returns 404, the malicious code or phishing forms cannot be examined directly.

Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, monitor for any traffic to Cloudflare‑hosted assets that reference the same technology fingerprint, and consider adding the domain to internal blocklists.