defituna[.]live

The domain defituna.live is currently offline but remains flagged as a crypto‑related brand‑impersonation campaign targeting Revolut. Registration records show the domain was created on September 03, 2025 and was registered through Web Commerce Communications Limited dba WebNic.cc. DNS resolution points to the Cloudflare edge address 104.21.75.89, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are dan.ns.cloudflare.com and ulla.ns.cloudflare.com, indicating reliance on Cloudflare's DNS infrastructure.

No TLS certificate is presented for the site, confirming the absence of HTTPS support at the time of analysis. VirusTotal scans report that nine of ninety‑five security vendors flagged the domain, demonstrating a modest consensus of malicious intent. Independent security tooling, including Gridinsoft, assigned a trust score of zero out of one hundred, reinforcing the perception of high risk. The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy.

The page title returned by the live host, "defituna - Leading DeFi Project," suggests an attempt to masquerade as a decentralized finance service, aligning with the reported crypto scam classification. While the specific content of the landing page has not been captured, the combination of brand impersonation, low trust score, vendor detections, and blocklist presence provides sufficient evidence for defensive action. Security teams should add defituna.live to network and endpoint blocklists, monitor DNS queries for the Cloudflare IP range for any resurgence, and enforce certificate validation policies to prevent accidental connections to similar unencrypted domains. Continued observation of newly registered domains using the same registrar or similar naming patterns is recommended to pre‑empt future campaigns.