defituna[.]io

This domain defituna.io is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Across brand. The site presents the page title “DeFiTuna” and is hosted on IP 93.94.52.242, which resolves to an AS215540 address in Germany operated by GLOBAL CONNECTIVITY SOLUTIONS LLP. Registration occurred on 23 August 2025 through Dynadot LLC, with authoritative nameservers ns1.dyna‑ns.net and ns2.dyna‑ns.net. The TLS certificate is issued by Let’s Encrypt (R12), and the HTTP response is a 301 redirect. Infrastructure analysis indicates a low Gridinsoft trust score of 23 / 100, and the campaign employs a Wallet Connect abuse kit, suggesting attempts to harvest cryptocurrency credentials via malicious wallet‑connect flows. VirusTotal reports a single positive detection among 95 scanned engines, and the domain is listed on two public blocklists, with explicit blocks enforced by MetaMask, ScamSniffer, PhishDestroy, and SEAL. Defenders should prioritize adding defituna.io to URL filtering and DNS block policies, monitor network traffic for connections to 93.94.52.242, and enforce strict validation of wallet‑connect requests. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response teams should be prepared to investigate any credential‑theft alerts that reference the Across brand or wallet‑connect interactions.