defishills[.]com

The domain defishills.com was registered on February 21, 2026 through NameCheap, Inc. and is currently active with an HTTP 200 response. The site presents the page title “DeFiShills: Your Gateway to Decentralized Finance Mastery,” indicating a focus on cryptocurrency services. The threat type is identified as a crypto drainer, and the campaign is listed as under investigation.

Infrastructure analysis shows the domain resolves to IP address 167.88.61.211, which is allocated to AS63023 GTHost and geolocated to the United States. Authoritative name servers are jon.quicns.com and kevin.quicns.com. The web server stack includes WordPress, MySQL, PHP, LiteSpeed, jQuery, and HTTP/3, confirming a typical content-management deployment. An SSL certificate issued by Let’s Encrypt (E8) secures the site.

Threat intelligence sources record a single AlienVault OTX pulse referencing the domain, and the domain appears on one external security blocklist. PhishDestroy has already blocked the domain, while a Gridinsoft trust score of 0 out of 100 suggests a high likelihood of malicious activity. No detections were reported on VirusTotal at the time of analysis, but the lack of detections does not imply benign behavior.

Defenders should consider adding defishills.com and its resolving IP 167.88.61.211 to network and DNS blocklists, monitor for any outbound connections to the host, and enforce strict controls on cryptocurrency transaction flows to mitigate potential drainer activity. Continuous threat‑intel monitoring is advised to detect any escalation, further sightings, or additional indicators of compromise associated with this infrastructure.