defillama-airdrop-swap[.]typedream[.]app

The domain defillama-airdrop-swap.typedream.app is presently offline, returning an HTTP 404 status, and has been taken down after detection by PhishDestroy. Infrastructure analysis shows the domain resolves to IP 104.21.37.85, which belongs to AS13335 operated by Cloudflare, Inc., and the hosting location is identified as the United States. Registration records indicate the domain was provisioned through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 trust anchor, confirming a valid HTTPS endpoint at the time of takedown. The site presented a page title of “DefiLlama - DeFi Dashboard,” suggesting an attempt to masquerade as the legitimate DeFi analytics platform.

Detected technology stacks include Node.js, React, Next.js, Google Cloud services, Google Cloud Trace, Google Cloud CDN, and Cloudflare Browser Insights, which are consistent with a modern JavaScript‑heavy web application but do not provide direct evidence of malicious payloads. Google Safe Browsing has flagged the domain for social engineering, and it appears on a single security blocklist. VirusTotal scans show ten of ninety‑five antivirus and URL‑reputation engines flagged the domain, reinforcing the suspicion of malicious activity. Nameserver information is unavailable (NS_NOT_FOUND).

The primary threat classification is a “Fake Airdrop” used as a crypto drainer, aiming to lure users into submitting private keys or wallet credentials under the pretense of receiving a DeFi token distribution. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any residual IP connections to 104.21.37.85, and update endpoint protection signatures to reflect the observed detection patterns.