defungiz[.]top

Analysis performed on July 23, 2026 confirms that the domain defungiz.top is being used for a wallet/seed phishing campaign. The site returned an HTTP 403 response when accessed, indicating that the content is deliberately hidden from casual visitors. VirusTotal records show that 16 of 93 security vendors have flagged the domain as malicious, providing independent corroboration of its threat status. Google Safe Browsing classifies the URL as a social engineering threat, reinforcing the phishing characterization.

The domain was registered on February 21, 2026 through the registrar 耐思尼克国际集团有限公司 and resolves to the IP address 188.114.96.3, which is hosted in the United States under ASN 13335 owned by Cloudflare, Inc. The SSL certificate presented is issued by Google Trust Services under the WE1 chain, a legitimate certificate authority that does not mitigate the malicious intent of the site. Nameserver records point to Earl.ns.cloudflare.com and Laura.ns.cloudflare.com, confirming Cloudflare’s DNS service. Infrastructure scans identified the hosting platform as Hostinger and the use of HTTP/3, both common in legitimate services but also employed by threat actors to blend in. The page title "Fun Guy iNFT Mint" suggests an attempt to lure victims with a cryptocurrency‑related premise, consistent with the observed wallet/seed phishing classification.

The domain is currently offline, but it has already been listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple defensive products have incorporated it into their protection sets. Defenders should continue to block the domain at network perimeter filters, update DNS sinkhole lists, and monitor for any re‑appearance of the domain or associated IP ranges.