definodechain[.]app

PhishDestroy identifies definodechain.app as an active crypto-drainer campaign distributing cryptocurrency-stealing malware under the guise of a blockchain node service. The domain mimics legitimate node infrastructure to trick users into connecting wallets and approving malicious transactions. No specific drainer kit family has been positively identified from available artifacts, but the operational pattern aligns with clipboard-hijacking and signature-request theft observed in recent campaigns targeting DeFi users.

This domain was flagged during routine threat-hunting using seed fa3130. Technical indicators include a VirusTotal score of 6/95 detections at time of analysis, registration via Dynadot LLC on September 22, 2025, and resolution to IP 188.114.97.3. The site holds a valid SSL certificate issued by Google Trust Services, which may enhance trust perception among victims despite its malicious intent. As of now, the domain remains unlisted on major blocklists including Google Safe Browsing, underscoring the need for proactive detection by security teams.

The campaign is currently active and spreading through social media and phishing forums. No takedown or blocklisting actions have been observed at this time. The remaining risk is HIGH due to the domain’s recent creation, low detection coverage, and use of trusted SSL infrastructure. Users are advised to block 188.114.97.3 and definodechain.app at the network level, avoid wallet connections, and report any interaction to their security provider. Organizations should monitor for outbound connections to this IP and inspect DNS logs for resolution attempts.