defilama-dex-secure[.]typedream[.]app

The domain defilama-dex-secure.typedream.app was observed hosting a crypto drainer campaign. The site presented the page title “DefiLama DeFi: Ultimate DeFi Analytics & Data Platform”, which is consistent with the branding of the legitimate DefiLama analytics service, indicating an attempt to spoof that service. VirusTotal scans returned three positive detections out of ninety‑five vendors, confirming malicious classification by multiple security engines. The SSL certificate is issued by Google Trust Services under the WE1 name, which is typical for Cloudflare‑protected sites and does not provide authentication of the underlying operator. DNS resolution points to IP address 104.21.37.85, which belongs to AS13335 Cloudflare, Inc. and is located in the United States.

The domain was registered on February 21 2026 through Squarespace Domains II LLC, a registrar commonly used for rapid deployment of disposable sites. Infrastructure fingerprints show a stack composed of Node.js, React, Next.js, Google Cloud services, and Cloudflare CDN, matching the technology profile of many modern phishing pages. Gridinsoft assigned a trust score of 0 out of 100, indicating a highly suspicious reputation. An HTTP request returned a 404 status, suggesting the malicious payload may have been removed or the site is being used as a placeholder. The site is currently taken offline and has been blocked by the PhishDestroy network; it also appears on a single security blocklist.

Uncertainty remains around the exact payload delivered to victims, as the page content has not been captured and the 404 response limits visible analysis. No public Safe Browsing or OTX entries were provided, and no additional intelligence on the specific smart‑contract addresses targeted by the drainer is available. Defenders should continue to monitor the IP address 104.21.37.85 for any resurgence of malicious activity, enforce domain‑level blocking for defilama-dex-secure.typedream.