defituna[.]org

Analysis of defituna.org indicates a confirmed phishing infrastructure targeting users of the Across protocol through wallet seed phishing tactics. The domain, registered on August 28, 2025, via Dynadot LLC, was taken offline by July 23, 2026, but remains a relevant indicator for retrospective threat hunting. Infrastructure analysis reveals the domain resolved to IP 93.94.52.242, hosted on AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in Germany, a network previously associated with phishing campaigns. The site operated without SSL encryption, a common red flag for fraudulent operations.

The page title 'DeFiTuna' and scam type 'Wallet/Seed Phishing' align with known phishing kits abusing Wallet Connect protocols, as documented in the available intelligence. Detection data shows 12 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two security blocklists (PhishDestroy and ScamSniffer). The absence of SSL, combined with the use of nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, further supports the classification as a phishing endpoint.

Defenders should treat this domain as a confirmed malicious indicator, particularly for campaigns targeting cryptocurrency wallet credentials. While the site is currently offline, historical DNS and WHOIS records should be reviewed for potential reuse of the infrastructure or related domains. No additional page content or visual evidence is available for deeper analysis, but the combination of hosting, detection, and known phishing kit usage provides sufficient grounds for blocking and alerting on this domain.