defituna.finance

Security‑vendor scans on VirusTotal report a single positive detection out of 95 scanners, indicating that at least one antivirus engine has flagged the domain as malicious. The domain appears on two independent blocklists, specifically PhishDestroy and ScamSniffer, and is listed on two broader security blocklists, reinforcing its classification as a phishing resource. A Gridinsoft trust score of 0 / 100 further corroborates the malicious intent. The observed phishing kit is identified as "Wallet Connect Abuse," a known toolkit used to harvest cryptocurrency wallet connections and seed phrases.

Defenders should immediately block defituna.finance at the DNS and proxy layers, add the associated IP address to network‑level deny lists, and enforce strict TLS inspection to capture any credential exfiltration attempts. Continuous monitoring of the IP range and related ASN is advised, as the operator may pivot to additional domains. Because only the page title and kit are currently observable, the exact user‑experience and targeted brands remain uncertain; however, the existing evidence—registrar details, hosting infrastructure, blocklist listings, low trust score, and identified kit—provides sufficient justification for proactive mitigation.