detifuna[.]net

This domain, detifuna.net, has been identified as a high‑risk brand‑impersonation site targeting the Across protocol. The registration record shows creation on 24 June 2025 through NiceNIC International Group Co., Limited, and the authoritative nameservers are amos.ns.cloudflare.com and tricia.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS infrastructure. DNS resolution points to IP address 172.67.167.133, which is owned by AS13335 Cloudflare, Inc., and geolocated to the United States. No TLS certificate is presented; the site serves over HTTP only, which further reduces credibility and suggests a hastily deployed operation.

The page title returned from the host is “Defituna – Decentralized Finance Platform for Crypto Staking & Yield Farming,” a theme commonly used in crypto‑draining campaigns, but the content has not been captured for analysis. Reputation services provide a scamadviser trust score of 1/100, reflecting extreme suspicion. VirusTotal reports that 16 of 95 scanned security vendors flagged the domain as malicious, and the domain appears on four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The domain is currently taken offline, which may be the result of takedown actions or a temporary suspension.

Defenders should continue to block detifuna.net at network perimeter and host‑based controls, and add the IP address 172.67.167.133 to any threat‑intel feeds that monitor Cloudflare‑hosted malicious infrastructure. Monitoring of the authoritative nameservers for re‑registration or new sub‑domains is recommended, as threat actors often reuse the same Cloudflare foothold for subsequent campaigns. Given the low trust score, lack of TLS, and the presence of malicious flags, any outbound connections to this domain should be denied, and any internal alerts that reference the page title or the Across brand should be correlated with this indicator for rapid incident response.