app-defilama-web3[.]pages[.]dev

Analysis of app-defilama-web3.pages.dev indicates a high‑risk crypto drainer operation that was taken offline prior to this report. The domain was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge IP 188.114.96.3, which is located in the United States and belongs to ASN 13335 (Cloudflare, Inc.). The site presented the page title "Suspected phishing site | Cloudflare" and returned HTTP 403, suggesting active blocking or intentional denial of access. TLS termination is performed by Google Trust Services using the WE1 certificate, and the site employed HSTS, Cloudflare protection, and HTTP/3.

VirusTotal scanned the domain and recorded 13 detections out of 93 security vendors, confirming malicious intent. Google Safe Browsing flagged the URL for social engineering, and PhishDestroy listed it as blocked. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist. Nameserver configuration consists of damian.ns.cloudflare.com and deb.ns.cloudflare.com, consistent with the registrar.

While the offline status limits immediate observation of payload delivery, the combination of a crypto scam classification, multiple vendor detections, and low trust scores provides strong evidence of a crypto‑draining phishing campaign. Defenders should ensure the domain is added to network‑level deny lists, update intrusion detection signatures to match the observed IP and TLS fingerprint, and monitor the associated Cloudflare nameservers for any re‑registration attempts. Continuous review of threat‑intel feeds for reappearance of the domain or related infrastructure is recommended.