defituna[.]xyz

Analysis of defituna.xyz indicates that the domain was actively used for a crypto‑drainer scam before being taken offline. The domain was registered on June 28, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.176.230 located in the United States. The authoritative name servers are lamar.ns.cloudflare.com and luciana.ns.cloudflare.com. No TLS certificate is associated with the site, meaning any traffic would have been unencrypted HTTP.

The page title returned from the live endpoint was "Pieni hetki...", which offers no additional context about the malicious payload. Reputation services flag the domain as highly untrustworthy: Scamadviser assigns a 1 out of 100 score, Gridinsoft reports a 0 out of 100 score, and the domain appears on a single security blocklist. VirusTotal scans show that three of ninety‑five antivirus engines flagged the domain, confirming at least some detection of malicious activity. The domain is currently blocked by the PhishDestroy network and is listed as offline, indicating that the hosting provider has removed the content or the operators have ceased operations.

Defenders should continue to deny resolution to 172.67.176.230, add the domain to local blocklists, and monitor Cloudflare‑associated IP ranges for similar patterns. Because the site lacked SSL, any credentials or wallet information submitted by victims would have been transmitted in clear text, facilitating theft. Ongoing surveillance of the registrar and the Cloudflare name servers is advised to detect re‑registration attempts or related infrastructure. Until further evidence emerges, the domain should be treated as a confirmed crypto‑drainer threat and excluded from all inbound traffic allowances.