defiresolver[.]xyz

The domain defiresolver.xyz has been identified as an active crypto drainer, which poses an elevated risk to users by targeting cryptocurrency assets. This domain does not appear to impersonate a well-known brand but instead utilizes the common phishing technique of misleading users into providing sensitive information through fake interfaces. There is no specific drainer kit identified in the available intelligence.

Technical indicators point to a VirusTotal detection score of 6/95, indicating a low percentage of security vendors flagging this threat. The domain was created on February 25, 2026, and it is registered through OwnRegistrar, Inc. Current resolution is to the IP address 104.21.28.188, and the domain appears on three different security blocklists. Gridinsoft assigns a trust score of 0/100 to this domain, indicating high suspicion of fraudulent intent.

Currently, defiresolver.xyz remains active, with detection counts from multiple security platforms leading to its blocking by at least three known services. Users should remain vigilant and avoid interactions with this domain due to its potential threats. It is advisable to regularly monitor crypto wallets for any unauthorized access or anomalies linked to activities originating from this domain.