definavigator[.]click

The domain definavigator.click was registered on 21 February 2026 through Tucows Domains Inc. and is currently taken offline. Infrastructure analysis shows the domain resolves to the IPv4 address 80.78.27.182, which belongs to AS39287 Materialism s.r.l. in Denmark. The authoritative nameservers are 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo, indicating the use of the Njalla privacy-focused DNS service. No TLS certificate was observed, meaning the site was served over plain HTTP only.

Threat intelligence classifies the site as a crypto drainer, a subset of crypto scams, and the page title returned by the server is "DeFi Platforms | The Future of Finance," suggesting an attempt to lure users interested in decentralized finance. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy feed. Gridinsoft assigned a trust score of 45 out of 100, reflecting a moderate risk rating. VirusTotal scanning recorded two positive detections out of ninety-three scanners, confirming that at least two security engines flagged the domain as malicious.

Because the site is offline, active content cannot be examined, and the exact phishing or draining mechanisms remain unknown. However, the combination of a recent registration, privacy-oriented nameservers, lack of encryption, and the presence on a blocklist aligns with typical infrastructure used by crypto-draining campaigns. Defenders should continue to block the domain at perimeter defenses, monitor the associated IP address for any resurgence, and add the nameserver set to watchlists for future domains that may reuse the same hosting. Incident response teams should also verify that no internal users have accessed the domain while it was live and, if necessary, purge any residual artifacts from endpoint logs.