defi-crm[.]com

The domain defi-crm.com is identified as a crypto drainer, a threat type designed to automatically siphon cryptocurrency assets from connected wallets. As of the latest analysis, the domain has been taken offline, though prior activity remains a confirmed risk. No legitimate brand impersonation has been observed, but the infrastructure and intent align with malicious wallet-draining operations. Analysis indicates the domain was created on February 21, 2026, and registered through Cloudflare, Inc. It resolves to the IP address 104.21.78.16 and is flagged by 1 of 95 VirusTotal security vendors. The domain appears on one security blocklist and holds a trust score of 0 out of 100. Detected technologies include Node.js, React, Next.js, HSTS, Google Analytics, Cloudflare Browser Insights, Cloudflare, and Webpack. The SSL certificate is issued by Google Trust Services, and the page title was recorded as "DEFICRM - CRM Multi-Secteur Intelligent." The current status of defi-crm.com is offline, but historical indicators confirm its use in crypto-draining campaigns. Users are advised to block all connections to this domain and associated IP addresses. Wallet holders should revoke any prior approvals or interactions with the domain and monitor transaction histories for unauthorized activity. Security teams should update blocklists to include the domain, its IP, and any related infrastructure to prevent potential reinfection or re-emergence.