defisofi[.]com

The domain defisofi.com is currently flagged as an active high-risk threat specializing in brand impersonation targeting Ethereum. Analysis confirms the domain is designed to mimic legitimate cryptocurrency exchange platforms, presenting itself as a service for buying and selling Bitcoin, Ethereum, and Tether. The page title, 'Defi Spot - Cryptocurrency Exchange | Buy & sell Bitcoin, Ethereum, Tether instantly,' reinforces this deception, aiming to exploit users seeking Ethereum-related financial services. Infrastructure analysis reveals the domain was registered through NameSilo, LLC, on May 23, 2026, and resolves to the IP address 102.212.247.139, hosted by Truehost Cloud LLC in Kenya. Security vendors have flagged defisofi.com with a detection ratio of 1 out of 95 on VirusTotal, indicating limited but present recognition as malicious. The domain appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its classification as a phishing threat. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites, providing a veneer of legitimacy. As of the latest assessment, defisofi.com remains active and operational, posing an ongoing risk to users. Organizations and individuals are advised to block the domain and its associated IP address (102.212.247.139) at the network level. Users should be educated to recognize impersonation tactics, particularly those involving cryptocurrency platforms. Monitoring for additional domains registered under the same infrastructure or registrar is recommended to identify potential related threats. Immediate reporting to relevant security teams and blocklist providers is encouraged to mitigate further exposure.