defilayerportal[.]xyz

The domain defilayerportal.xyz was registered on July 06, 2025 through Porkbun LLC and resolved to the IPv4 address 198.251.89.220, which is hosted in the United States under ASN 53667 (FranTech Solutions). No TLS certificate was presented, so all HTTP traffic was delivered over clear‑text connections, and the server responded with HTTP 200 for the default request. The page title returned by the server was “DeFi Saver,” and the domain is classified as a crypto‑drainer scam in the supplied intelligence. Multiple independent security services have flagged the domain: PhishDestroy and ScamSniffer listed it as blocked, and it appears on two external blocklists.

Reputation services gave it extremely low scores—Scamadviser assigned 1 / 100 and Gridinsoft 0 / 100—indicating a high likelihood of malicious intent. VirusTotal scans reported four detections out of ninety‑five antivirus engines, reinforcing the suspicion. The domain is currently taken offline, limiting direct observation of the payload, but the existing artifacts suggest a typical crypto‑drainer workflow that likely attempted to harvest private keys or redirect users to fraudulent wallet interfaces. Defenders should continue to block DNS resolution for defilayerportal.xyz and its associated IP 198.251.89.220 at perimeter firewalls and DNS filtering solutions.

Monitoring for newly registered domains that share the same registrar (Porkbun LLC) or the same hosting ASN may help detect repeat offenders. Because the site lacked SSL, any attempted connections could be intercepted for forensic capture, providing additional evidence. Analysts should treat any future sightings of this domain or similar naming patterns as high‑confidence crypto‑drainer activity and prioritize containment and user‑education measures accordingly.