deffilama[.]framer[.]wiki

This report details the technical threat posed by the domain deffilama.framer.wiki. Based on its page title, "Official Website Login wiith Defillama Wallet," the site is a fraudulent cryptocurrency platform designed to impersonate the legitimate DefiLlama brand. The misspelling in the title ("wiith") is a common indicator of a phishing or credential-harvesting operation, where the threat is to steal users' wallet login credentials and subsequently their cryptocurrency assets.

Technical analysis confirms the malicious nature of the site. VirusTotal flagged the domain with 4 detections out of 95 security vendors, and it was identified as a threat by ChainPatrol, alphaMountain.ai, CyRadar, and SOCRadar. The domain is hosted on three blocklists. Its infrastructure is registered through CSC Corporate Domains, Inc., with the IP address 52.223.52.2 located in the United States and belonging to the AS16509 Amazon.com, Inc. network. The SSL certificate was issued by Let's Encrypt (E8), and the nameservers were ns-1185.awsdns-20.org, ns-423.awsdns-52.com, and ns-1827.awsdns-36.co.uk.

The current status of deffilama.framer.wiki is DOWN/OFFLINE. Despite being inactive, the risk level remains high due to the site's specific targeting of cryptocurrency wallet credentials. The combination of low VirusTotal detection, hosting on a major cloud provider, and use of a legitimate SSL certificate indicates the site was designed to evade basic security checks while it was active.