defillama-4e386f[.]webflow[.]io

PhishDestroy confirms defillama-4e386f.webflow.io as an active crypto drainer site impersonating the legitimate DeFiLlama analytics platform. The page leverages Webflow hosting to deliver a malicious wallet-draining kit that siphons tokens via fake transaction approval prompts. Victims who connect wallets are immediately exposed to unauthorized fund transfers, with the drainer kit masquerading as a “portfolio tracker” to lower user suspicion.

Technical indicators for this domain are consistent with a high-risk operation: the SSL certificate is issued by Google Trust Services, indicating an attempt to appear legitimate, while the domain resolves to IP 104.18.36.248. VirusTotal analysis shows only 1 out of 95 security vendors currently detect the threat, highlighting the stealthiness of this campaign. No registrar or creation date data is publicly available at this time, and the domain has not been flagged by Google Safe Browsing (GSB) as of the latest scan. Despite low detection rates, the site remains unlisted on major blocklists, increasing exposure risk.

As of today, defillama-4e386f.webflow.io remains active and continues to propagate via social media and phishing links targeting DeFi users. PhishDestroy recommends immediate blocking of the domain and IP at network and endpoint levels. Users are urged to verify website URLs manually, avoid clicking unsolicited links, and use hardware wallets or transaction simulation tools before approving any blockchain interactions. Remaining risk is elevated due to low detection coverage and ongoing domain availability. Monitor for updates as this threat evolves.