defiwebchainprotocols[.]firebaseapp[.]com

defiwebchainprotocols.firebaseapp.com was observed hosting a crypto‑drainer operation. The domain resolves to the IPv6 address 2620:0:890::100, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. Registration information shows the domain was created through Google LLC, using the Google‑provided nameserver ns-cloud.googledomains.com. The site presented an HTTP 404 response with the page title “Site Not Found”, and the SSL certificate was issued by Google Trust Services (WR4), indicating a valid TLS configuration with HSTS and HTTP/3 support.

Reputation data is uniformly negative: Scamadviser assigns a trust score of 1 / 100, and the domain appears on four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis recorded seven detections out of ninety‑five scanners, reinforcing the malicious classification. The listed scam type is “Crypto Scam”, consistent with the observed crypto‑drainer activity. As of the report date (24 July 2026) the host is taken offline, which limits direct observation of the payload or victim‑interaction flow.

No additional page content, redirect behavior, or malicious scripts have been captured, leaving the exact mechanism of fund extraction undocumented. Nevertheless, the convergence of low trust score, multiple blocklist listings, vendor detections, and the explicit “Crypto Scam” label provides sufficient evidence for security teams to treat the domain as hostile. Defenders should continue to block the domain at network perimeter and DNS layers, update intrusion‑detection signatures with the IPv6 address and associated certificate fingerprint, and monitor for any re‑registration attempts under the same sub‑domain pattern. Ongoing threat‑intel feeds should be consulted for potential reuse of the Fastly hosting infrastructure in other crypto‑drainer campaigns.