defillama-pro-en[.]pages[.]dev

The domain defillama-pro-en.pages.dev was registered through Cloudflare on 9 November 2025 and resolves to the Cloudflare‑owned address 172.66.44.194 (AS13335). The site presents the page title “DeFiLlama Wallet | Secure DeFi & Crypto Management”, which aligns with a wallet‑seed phishing campaign that impersonates the “across” brand. The SSL certificate is issued by Google Trust Services under the WE1 root, indicating a valid TLS chain despite the malicious intent. DNS is served by brodie.ns.cloudflare.com and georgia.ns.cloudflare.com, both Cloudflare name‑servers.

HTTP requests return a 403 status, and the page is currently taken offline, but historical scans show the site used HSTS and HTTP/3. Reputation checks show a Gridinsoft trust score of 0 / 100 and placement on one security blocklist. Google Safe Browsing classifies the domain as social engineering, and VirusTotal recorded detections from 16 of 95 scanners. PhishDestroy has also blocked the domain.

The combination of a brand‑impersonating page title, low trust scores, multiple vendor detections, and active blocklist entries indicates a high‑risk wallet/seed phishing operation. Defenders should add the domain and its IP to blocklists, monitor for re‑registration of the sub‑domain, and incorporate the observed SSL issuer and HTTP headers into detection signatures. Because the site is offline, further content analysis is not possible; however, the available metadata confirms the domain’s malicious purpose and warrants continued vigilance.