defillama-en-es[.]created[.]app

Analysis of defillama-en-es.created.app shows a high‑risk crypto drainer that has been taken offline as of the report date, July 23 2026. The domain was registered through Tucows Domains Inc. on July 12 2023 and resolves to the Amazon‑owned IP address 216.150.1.65, located in the United States (AS16509). DNS is served by ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site was hosted on the Vercel platform and enforced HTTP Strict Transport Security. An SSL certificate from Let’s Encrypt (R13) was present, providing encrypted HTTPS despite the malicious intent.

The HTTP response returned a 404 status, suggesting the content was removed or the site was abruptly taken down. The page title captured by crawlers reads "DefiLlama Wallet Overview: Tracking & Managing DeFi Assets Easily," which aligns with the declared scam type of a crypto scam and the threat classification of a crypto drainer. The domain is listed on one security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans flagged the domain in 13 of 95 security engines, and Google Safe Browsing identified it as a social‑engineering threat.

These independent detections corroborate the malicious classification. While the site is currently offline, the infrastructure—particularly the Vercel hosting and the Amazon IP—could be re‑used for future campaigns, and the domain’s creation date suggests a relatively recent setup. Defenders should continue to deny any network traffic to 216.150.1.65, add the domain and its IP to internal DNS and proxy blocklists, monitor for re‑registration or similar sub‑domains under the same registrar, and keep an eye on alerts from the listed security vendors. Awareness campaigns targeting DeFi users should reference the observed page title and the crypto‑drainer technique to reduce the likelihood of credential or wallet compromise.