defil-1[.]gitbook[.]io

The domain defil-1.gitbook.io has been identified as a high-risk crypto drainer currently active as of July 12, 2026. Registered on June 08, 2026, through GitBook, this domain has a trust score of 0 out of 100 according to Gridinsoft, indicating a high level of concern regarding its legitimacy. The domain has been flagged by 5 out of 95 security vendors on VirusTotal, suggesting that it is recognized within the cybersecurity community as potentially malicious. Furthermore, it appears on five separate security blocklists, including SEAL, MetaMask, PhishDestroy, OISD, and BLP-Malware, reinforcing its classification as a threat.

Infrastructure analysis reveals that the domain resolves to the IP address 104.18.40.47. This IP address is likely shared among multiple domains, a common practice in malicious activity to obfuscate true ownership. The SSL certificate is issued by Google Trust Services, which may lend a false sense of security to users unaware of the domain's malicious intent. The title of the page, "DeFIL介绍 | DeFIL," suggests it may impersonate a legitimate brand in the cryptocurrency sector, particularly a service or project related to 'DeFIL'.

Given the high detection counts and the active status of this domain, defenders should be vigilant and consider blocking access to it across their networks. Awareness training should be conducted to inform users about the potential for such threats, particularly in context with cryptocurrency transactions. It is recommended to monitor any interactions with this domain and to employ advanced threat detection systems to prevent any potential data breaches. Additionally, continuous updates from cybersecurity platforms should be reviewed to stay informed about any changes in the status of this domain.