defi-chains[.]com

The domain defi-chains.com was registered on February 19, 2025 through Global Domain Group LLC and is presently taken offline. Infrastructure analysis shows the site resolved to IP 198.251.89.168, which belongs to AS53667 FranTech Solutions and is geolocated in the United States. The host operated a LiteSpeed web server with HTTP/3 support and presented a Let’s Encrypt certificate (issuer E7). Nameserver delegation includes ns9.asurahosting.com, ns10.asurahosting.com, ns9.my-cont, and ns10.my-control-panel.com, indicating a mixed hosting environment.

Threat intelligence flags the domain as a crypto drainer: it appears on four security blocklists, is blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, and has an AlienVault OTX entry in one pulse. VirusTotal recorded detections from 11 of 95 scanned vendors, reinforcing the malicious classification. Reputation services assign extremely low scores—Scamadviser rates it 1 / 100 and Gridinsoft 0 / 100—consistent with the observed scam type labeled as a crypto scam. The page title returned by the server is simply "defi‑chains.com," providing no additional context about the payload.

Uncertainty remains regarding any active payload or the specific tactics employed, as no forensic snapshot of the site content is available. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑hosting attempts, and add the IP address and associated nameservers to threat feeds. Continuous re‑validation of blocklist status and periodic rescans of the IP range are advised to capture potential resurgence.