salute-origindefi[.]com

The domain salute-origindefi.com was registered on 14 December 2025 through HOSTINGER operations, UAB and resolves to the IPv4 address 84.32.84.116, which is part of AS47583 Hostinger International Limited located in Lithuania. No TLS certificate is presented, and the HTTP response returns the page title “Checking your browser before accessing. Just a moment…”, a generic interstitial often used by malicious operators to hinder automated analysis.

VirusTotal reports show that four of ninety‑five scanned security vendors flagged the domain, indicating consensus among scanners that the site is malicious. The domain is listed on five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura—further confirming its reputation as a crypto‑drainer campaign. Gridinsoft assigns a trust score of 0 out of 100, reflecting the highest level of risk.

As of the report date the site is taken offline, limiting direct observation of the payload or credential‑harvesting mechanisms. Consequently, the exact techniques employed by the campaign remain uncertain, although the classification as a crypto scam implies attempts to illicitly redirect cryptocurrency transactions or harvest private keys. Defenders should proactively block the domain and its resolving IP, incorporate the listed blocklist identifiers into intrusion‑detection signatures, and monitor Hostinger‑owned infrastructure for similar patterns that may indicate re‑use of the same hosting environment for future malicious deployments.