app-defilam-app[.]umso[.]co

Analysis of app-defilam-app.umso.co indicates that the domain is currently taken offline but retains multiple indicators of malicious activity consistent with a crypto‑drainer operation. The domain resolves to IP address 75.2.96.155, an Amazon Web Services host located in the United States, confirming the infrastructure is provisioned on a reputable cloud provider (ASN16509). Registration records show the domain was created on August 31, 2020 through Name.com, Inc., and the authoritative name servers are ns-1432.awsdns-51.org, ns-15.awsdns-01.com, ns-1794.awsdns-32.co.uk, and ns-900.awsdns-. The TLS certificate is issued by Let’s Encrypt (R12), which is typical for short‑lived or disposable sites.

HTTP probing returned a 404 status code, suggesting the landing page is no longer served, yet the page title captured during prior scans reads "DefiLlama Wallet Guide — Connect & Track DeFi |," a title that aligns with legitimate DeFi services and may have been used to lure victims into connecting cryptocurrency wallets. Google Safe Browsing flagged the domain for social engineering, and the site appears on a single security blocklist, specifically PhishDestroy. VirusTotal analysis recorded 15 detections out of 95 security vendors, reinforcing the consensus that the domain is malicious. Although the current offline status prevents direct inspection of payloads or wallet‑draining scripts, the combination of cloud hosting, recent SSL issuance, a deceptive DeFi‑related title, and multiple vendor detections strongly supports classification as a crypto‑drainer.

Defenders should add the domain and its resolving IP to block lists, enforce DNS sinkholing for the associated nameservers, and monitor for any newly registered subdomains that resolve to the same AWS address space.