defillama-app[.]github[.]io

The domain defillama-app.github.io was registered on February 21, 2026 through MarkMonitor, Inc. and is currently listed as offline, returning an HTTP 404 response. DNS resolution points to the IPv6 address 2606:50c0:8001::153, which belongs to Fastly, Inc. (AS54113) and is hosted in the United States. The site presents a TLS certificate issued by Let’s Encrypt under the R12 profile, confirming that HTTPS is available despite the 404 status. Header analysis reveals the presence of Varnish caching, GitHub Pages hosting, and Fastly CDN services, indicating a typical static‑site delivery pipeline rather than a bespoke server environment.

The page title returned by the server is "DefiLlama™ | Home | Official Website," matching the brand name of a known DeFi analytics platform, but the content of the page has not been examined and therefore cannot be confirmed as authentic or malicious. The domain is classified as a crypto scam, specifically a crypto drainer, and has been flagged by three of ninety‑three VirusTotal scanners. It appears on a single security blocklist and is actively blocked by PhishDestroy, suggesting that threat‑intel operators have observed malicious activity associated with this pointer. While the evidence points to an attempt to impersonate a reputable DeFi service and to lure cryptocurrency credentials, the exact payload, phishing pages, or wallet‑draining mechanisms have not been captured.

Consequently, defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any DNS queries to the associated IPv6 address, and enforce strict verification of TLS certificate fingerprints for any communications claiming to be DefiLlama. Additional sandboxing of any content retrieved from the host, as well as correlation with user reports of unauthorized crypto transactions, will help determine whether the drainer component is active.