defivmarket[.]com

defivmarket.com is an active crypto-drainer phishing domain posing an elevated risk to cryptocurrency users. The threat involves malicious JavaScript designed to covertly drain funds from connected wallets by intercepting and manipulating transaction requests. This campaign specifically targets users seeking cryptocurrency trading opportunities, luring them to a fake digital asset market where wallet approvals trigger illicit fund transfers. This domain was flagged by only 1 out of 95 security vendors on VirusTotal, indicating limited but meaningful detection coverage. It was registered through Name SRS AB on April 16, 2026, and resolves to IP address 185.114.97.3. The domain holds a Let’s Encrypt SSL certificate, increasing perceived legitimacy. Its recent creation and low detection rate suggest a possible emerging threat with minimal exposure to public blocklists. Trust indicators are further compromised by the high-risk association with crypto-draining malware widely distributed in underground forums. Mitigation begins with immediate avoidance of defivmarket.com and any related URLs or social media promotions tied to this domain. Users who have previously visited or connected a wallet should revoke all smart contract approvals via tools like revoke.cash or similar platforms, and transfer remaining assets to a newly generated wallet. Monitor connected wallets and blockchain activity for unauthorized transactions or suspicious approvals. Report the domain to threat intelligence platforms and local cybercrime units. Consider deploying browser extensions that detect malicious wallet interactions and enable hardened security settings on wallets to prevent script-based fund transfers.