defillama-defi-swap[.]typedream[.]app
“Suspected phishing site | Cloudflare”
defillama-defi-swap.typedream.app — 内容不可用. 诈骗类型:Crypto Scam. 证据摘要: VirusTotal 11/93 (ChainPatrol, alphaMountain.ai, BitDefender, CyRadar, Forcepoint ThreatSeeker); PhishDestroy score 83/100. 注册商: Squarespace Domains II.
为保留原始取证记录,下方的 PhishDestroy AI 详细分析仍使用英文。
defillama-defi-swap.typedream.app was observed delivering a crypto‑drainer campaign. The site returned HTTP 403 and displayed the Cloudflare page titled “Suspected phishing site | Cloudflare”. The domain was registered on February 21 2026 through Squarespace Domains II LLC and resolves to 172.67.206.36, an address owned by AS13335 Cloudflare, Inc., located in the United States. SSL termination is provided by Google Trust Services under the WE1 certificate, indicating use of Google Cloud infrastructure.
Front‑end components identified include Node.js, React, Next.js, Webpack and Google Cloud CDN, while server‑side traces point to Google Cloud Trace. The site appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows 11 of 93 scanners flag the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. The combination of a newly created domain, low trust rating, and multiple vendor detections aligns with the “Crypto Scam” classification in the known intelligence.
No additional payload or wallet address information has been disclosed, so the exact method of fund extraction remains unclear. Defenders should continue to block the domain at DNS and proxy layers, monitor outbound traffic to the IP 172.67.206.36 for anomalous cryptocurrency‑related connections, and update intrusion‑prevention signatures to reflect the observed technology stack. Analysts should also query threat‑intel feeds for any emerging indicators of compromise linked to this host, and consider adding the domain to internal blocklists pending further investigation.
威胁响应 Pipeline
公共封禁名单状态
所用技术 · 9 identified
Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.
nodejs.org 置信度 100%React is an open-source JavaScript library for building user interfaces or UI components.
reactjs.org 置信度 100%Next.js is a React framework for developing single page Javascript applications.
nextjs.org 置信度 100%Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.
cloud.google.com 置信度 100%Cloud CDN uses Google's global edge network to serve content closer to users.
cloud.google.com 置信度 100%Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.com 置信度 100%HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.org 置信度 100%VirusTotal 分析
网站配置分析
证据与外部报告
您是否受到本网站的影响?
如果您输入了帐户凭据、个人或付款信息,或者从此域下载了文件,请立即采取措施。以下资源可帮助您报告事件并保护自己。