defillama-es-co[.]pages[.]dev

The domain defillama-es-co.pages.dev was registered on February 21, 2026 and hosted on Cloudflare infrastructure, resolving to IP address 188.114.96.3 located in the United States under ASN 13335 (Cloudflare, Inc.). The site presented the page title "Home | DeFiLlama Wallet (2025)", indicating an attempt to masquerade as the legitimate DeFiLlama wallet service. TLS termination is performed by a Google Trust Services certificate (WE1), and the site enforced HSTS while supporting HTTP/3, suggesting a modern, well‑configured web server. An HTTP 403 response was observed, and the domain is currently listed as offline, yet the fingerprinted metadata remains accessible for analysis.

Reputation services flag the domain as malicious: 11 of 93 VirusTotal scanners raised alerts, Google Safe Browsing classifies it as social engineering, and a Gridinsoft trust score of 0 / 100 was recorded. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, confirming its use in wallet/seed phishing campaigns. The registration details show the domain was provisioned through Cloudflare, Inc., using the nameservers sandy.ns.cloudflare.com and dante.ns.cloudflare.com, which is consistent with the hosting provider’s automated provisioning process. While the page title provides clear evidence of brand impersonation, other content has not been publicly disclosed, leaving the exact phishing payload unknown.

Defenders should immediately block the domain at perimeter defenses, add it to threat‑intelligence feeds, and monitor for any future resolution changes that could indicate re‑use of the same infrastructure. Continuous observation of the associated IP range (188.114.96.0/24) is advisable, as Cloudflare often hosts multiple malicious actors on shared addresses. Organizations that use DeFiLlama services should educate users about the risk of unsolicited wallet links and enforce multi‑factor authentication where possible.