get-deflama-io-walts[.]framer[.]ai

Analysis of the domain get-deflama-io-walts.framer.ai indicates that it was registered on 2023-04-04 through CSC Corporate Domains, Inc. and is hosted on Amazon Web Services (ASN 16509) in the United States, resolving to 52.223.52.2. The site employed a Let’s Encrypt E8 certificate and responded with HTTP 404, while HSTS and HTTP/3 were observed, consistent with the Framer Sites and React stack detected. The page title “DefiLlama Wallet Guide — Connect & Track DeFi” and the classification as a crypto‑scam suggest an attempt to impersonate the DefiLlama platform and lure users into revealing wallet credentials.

The domain appears on a single blocklist and was flagged by PhishDestroy. VirusTotal recorded one positive detection out of ninety‑three scanners, confirming that at least one security vendor identified malicious behavior. The infrastructure—AWS nameservers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns—matches typical legitimate cloud deployments, making automated detection reliant on content‑based signatures rather than hosting anomalies.

The site is currently offline, returning 404, which limits immediate observation but does not guarantee the removal of any previously distributed malicious payloads or phishing links. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any residual URLs that reference the same host, and update detection rules to include the observed page title and the specific combination of Framer‑based technologies with a Let’s Encrypt certificate. Incident response teams should also verify that any credential‑theft attempts targeting DefiLlama users are investigated, and users should be warned to disregard unsolicited wallet‑setup instructions originating from this domain.