defimarket[.]it[.]com

This domain, defimarket.it.com, is actively flagged as a high‑risk crypto‑drainer infrastructure as of 28 July 2026. VirusTotal reports that 1 of 91 scanning engines has identified malicious behavior associated with the domain, indicating at least one detection of suspicious activity. The domain is presently listed on three independent security blocklists and is actively blocked by commercial filtering services PhishDestroy, MetaMask, and SEAL, suggesting that multiple anti‑phishing and wallet‑protection solutions have incorporated it into their deny lists. DNS resolution points to the IP address 104.21.82.181, which is hosted on Cloudflare infrastructure; the authoritative name servers are justin.ns.cloudflare.com and melissa.ns.cloudflare.com.

The use of Cloudflare’s generic name servers does not, by itself, imply malicious intent, but the convergence of blocklist entries, vendor detection, and active blocking indicates a concerted effort to disrupt legitimate cryptocurrency operations. The available intelligence does not include a page title, SSL certificate details, HTTP response codes, or any observed content, leaving the exact delivery mechanism of the crypto‑drainer unknown. Likewise, no attribution to a specific threat actor, toolkit, or affiliate campaign can be confirmed from the current data set.

Analysts should therefore prioritize network‑level prevention: enforce DNS sinkholing or blocklist rules for the resolved IP 104.21.82.181, and configure endpoint security solutions to deny connections to defimarket.it.com. Continuous monitoring of VirusTotal and other reputation services is recommended to capture any additional detections that may emerge as the campaign evolves. Organizations that expose cryptocurrency wallets or interact with decentralized finance platforms should also alert users to the presence of this domain and advise against any unsolicited transaction requests that reference it.