ludefi[.]com

Ludefi.com is identified as a crypto drainer phishing domain, designed to deceive users into connecting their cryptocurrency wallets and subsequently draining funds. The page title observed was 'Ludefi,' which may mimic a legitimate decentralized finance (DeFi) platform, though no specific brand was explicitly targeted. The domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to IP address 96.126.125.147. Infrastructure analysis reveals the use of Nginx as the web server, Zoho for potential services, HSTS for security header enforcement, and an SSL certificate issued by Let's Encrypt.

Technical indicators are as follows: VirusTotal shows a detection rate of 5 out of 95 security vendors flagging this domain as malicious. The domain appears on 1 security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating high risk. Google Safe Browsing (GSB) status was not explicitly provided, but the domain's presence on a blocklist and low trust score suggest potential threat. The domain is currently offline, as confirmed by the seed data, which reduces immediate risk but does not eliminate the possibility of reactivation or domain reuse.

Current status indicates the domain has been taken offline, likely due to proactive takedown actions or automated blocking systems. No specific drainer kit was identified in the available intelligence. Remaining risk includes potential domain resurrection under a new registrar or IP, as well as similar domains registered by the same threat actor. Users who previously interacted with ludefi.com should revoke any wallet permissions and monitor for unauthorized transactions. The low security vendor detection count (5 out of 95) underscores the challenge of early identification, emphasizing the need for user vigilance and layered security measures.