defillama-protocol[.]pages[.]dev

Analysis as of July 24, 2026 indicates that defillama-protocol.pages.dev is an active brand-impersonation campaign targeting users of the DefiLlama service. The site was registered on February 21, 2026 and is hosted behind Cloudflare, Inc., resolving to IP address 172.66.47.162, which is assigned to AS13335 in the United States. The domain employs HSTS and HTTP/3, and its TLS certificate is issued by Google Trust Services under the WE1 root, confirming the presence of a valid HTTPS endpoint despite the malicious intent. The page title returned by the server reads “Official DefiLlama® | DeFi Analytics & Secure Exchange Guide,” which directly mirrors the legitimate brand’s naming conventions and supports the classification as a wallet/seed phishing operation.

Google Safe Browsing has flagged the URL for social engineering, and 12 of 93 security vendors on VirusTotal have marked the domain as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility of the site. The HTTP response code is 403, indicating that the server is currently denying access, and the domain is listed on a single security blocklist.

PhishDestroy has already blocked the domain, and the current status is recorded as offline. Defenders should continue to enforce blocklist rules for the domain and its associated IP, monitor for any resurrection of the site under new subdomains, and educate end users that any unsolicited request for wallet credentials or seed phrases originating from a URL containing “defillama-protocol.pages.dev” is malicious. Because the infrastructure relies on Cloudflare’s generic edge network, further attribution to a specific operator is not possible at this time, and investigators should focus on traffic patterns and any future DNS changes to detect re-use of the same hosting assets.