defituna.to — Brand Impersonation Investigation

Analysis of defituna.to indicates an active high‑risk brand‑impersonation operation targeting Solana. The domain is registered through the Government of the Kingdom of Tonga and resolves to IP 130.12.180.128, which is geolocated in the Netherlands and attributed to Virtualine Technologies. TLS is provided by a Let's Encrypt certificate (YE2) and the web server responds with HTTP 200, identified as Nginx running OpenResty. The page title delivered by the site reads “DeFiTuna | Solana DEX,” confirming the use of the Solana brand in the content. Infrastructure signals are weak, evidenced by a Gridinsoft trust score of 0 / 100 and detection by six of ninety‑one VirusTotal scanners. The domain appears on three public blocklists and has been cited in two AlienVault OTX threat pulses. It is also listed by PhishDestroy, MetaMask, and SEAL as a known malicious entity. While the site’s exact payload and user‑facing elements have not been examined, the combination of brand‑specific title, low trust score, and multiple blocklist entries substantiates a credible impersonation threat. Defenders should block defituna.to at network perimeter, monitor DNS queries for the domain, and enforce strict verification of Solana‑related URLs. Users should be warned against visiting the site and any credential or wallet address entry should be treated as compromised. Continued observation is advised to capture any evolution of the hosting infrastructure or new indicator sets.