difi-off[.]netlify[.]app

PhishDestroy identifies difi-off.netlify.app (seed: f8e853) as a live phishing domain masquerading as a Trust Wallet transfer portal. This domain leverages a deceptive page title, 'Transfer Trust Wallet,' to trick users into entering wallet credentials or initiating fraudulent transfers, aligning with generic drainer kit behaviors observed in similar campaigns. The infrastructure appears designed to harvest sensitive data under the guise of legitimate cryptocurrency operations, posing a direct threat to users' digital assets.

Technical indicators confirm this domain's malicious intent: VirusTotal currently flags it with 2/95 detections despite active probing, suggesting evasion tactics are in play. Registered via Netlify, the domain resolves to IP 63.176.8.218, secured with a DigiCert SSL certificate—exploiting trust in legitimate issuers. While specific creation dates and blocklist counts remain unverified in public feeds, the absence of detections and SSL certificate use indicate a well-camouflaged operation. Google Safe Browsing (GSB) status and broader blocklist inclusion require further investigation to establish historical context.

Currently active and unblocked, difi-off.netlify.app represents an immediate risk to cryptocurrency users. Users are advised to avoid interacting with this domain and report it to their security teams. Immediate actions include DNS blocking of 63.176.8.218, updating firewall rules, and monitoring for associated IOCs in network traffic. Remaining risk is classified as under investigation pending additional telemetry; however, the domain's active status and lack of detections necessitate urgent containment to prevent further compromise.