defillama-wallet[.]blogspot[.]com

The domain defillama-wallet.blogspot.com is a phishing site designed to function as a crypto drainer, a type of scam that automatically siphons cryptocurrency from connected wallets. It does not impersonate a specific legitimate brand but uses the name 'DefiLlama' to appear credible. As of the latest verification, defillama-wallet.blogspot.com has been taken offline, though it previously posed an elevated risk to users who interacted with it.

Technical analysis shows that defillama-wallet.blogspot.com was flagged by 1 of 95 security vendors on VirusTotal, including ChainPatrol. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through MarkMonitor, Inc. on July 31, 2000, and resolved to the IPv6 address 2a00:1450:4001:813::2001, hosted by Google LLC in Germany. The SSL certificate was issued by Google Trust Services / WE2, and the observed page title was 'DefiLlama Wallet – Manage DeFi Assets Securely'. The site returned an HTTP 404 status at the time of assessment and was detected using technologies such as Blogger, Java, Python, OpenGSE, and HTTP/3.

Users who connected a wallet to defillama-wallet.blogspot.com should immediately revoke all token approvals using a tool like Etherscan’s token approval checker or Revoke.cash. Funds should be moved to a new, secure wallet to prevent further unauthorized transactions. Victims are advised to report the domain to their wallet provider, local cybercrime authorities, and platforms like ChainPatrol or PhishTank to aid in takedown efforts. Enabling two-factor authentication on all accounts and monitoring for suspicious transactions is also recommended.